VulnerabilityDeferred

CVE-2026-0829

The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks.

MEDIUM 5.8EPSS 0.68%

Does this matter?

Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.

Description

The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.

CVSS 3.1: 5.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS: 0.68% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.