EUVD-2026-39626

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugi...

CVE-2026-8380

The CVE concerns the WordPress plugin Frontend File Manager (nmedia-user-file-uploader) <= 23.6. It presents an authorization flaw in the wpfm_delete_file AJAX action: ownership is verified via file_id, but the deletion loop uses file_ids[] without validating ownership for each item, allowing ...