CVE Explorer
CVE-2026-16292
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unknown","product":"Frontend File Manager Plugin","vendor":"Unknown","versions":[{"lessThanOrEqual":"23.6","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:fb55518920cddee8a959908c2d4b639f7490ca1be025a5e192286343561edaad · sha256:d04386a76f751c8b… · /containers/cna/affected/0
CWE assertions
1 source assertion{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:fb55518920cddee8a959908c2d4b639f7490ca1be025a5e192286343561edaad · sha256:d04386a76f751c8b… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/7c0a8f6e-c460-4157-9ed9-3c5e9b1f1591/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:fb55518920cddee8a959908c2d4b639f7490ca1be025a5e192286343561edaad · sha256:d04386a76f751c8b… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.