Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-0829

The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:0c93870f0ff1cf036e54eaf7229cf7427acc449cac86c8b93a0bcffc42fda3fa
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/adp/0/problemTypes/0/descriptions/0

{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"defaultStatus":"unknown","product":"Frontend File Manager Plugin","vendor":"Unknown","versions":[{"lessThanOrEqual":"23.5","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9ea46f201aa5849fe2fa0627cc3fc2b05fb717674b4e761bbcab0bef7b2937f6 · sha256:2a3201e0a45af81f… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer