CVE-2026-8380

The CVE concerns the WordPress plugin Frontend File Manager (nmedia-user-file-uploader) <= 23.6. It presents an authorization flaw in the wpfm_delete_file AJAX action: ownership is verified via file_id, but the deletion loop uses file_ids[] without validating ownership for each item, allowing ...