CVE-2026-8380 Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion
Authenticated authors can permanently delete arbitrary posts due to missing ownership checks, with unauthenticated access possible if guest uploads are enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8380?
CVE-2026-8380 is a medium-severity missing authorization vulnerability in Unknown Frontend File Manager Plugin, published on 26 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
Which versions are affected by CVE-2026-8380?
How do I fix CVE-2026-8380?
No fix has been published for CVE-2026-8380 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-8380 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-8380 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-rxrc-7q8v-cgpx.