Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

WordPress Frontend File Manager Plugin Allows Unauthenticated Email Spam

CVE-2026-0829 · published 8 months ago
Summary

An outdated version of the Frontend File Manager Plugin for WordPress lets attackers send spam emails and access sensitive files without permission. This can be exploited by anyone who knows the file IDs. To fix this, update the plugin to the latest version.

Original advisory text
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site a...
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published17 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-0829 · NVD
Track software like this
Free during beta