CVE-2026-16292: Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16292?
CVE-2026-16292 has a risk score of 48, indicating a moderate level of severity.
How do I fix CVE-2026-16292?
To fix CVE-2026-16292, update the Frontend File Manager Plugin to the latest version that addresses this CSRF vulnerability.
What is the impact of CVE-2026-16292?
CVE-2026-16292 allows attackers to modify file metadata through CSRF, potentially enabling unauthorized file downloads.
Which versions are affected by CVE-2026-16292?
CVE-2026-16292 affects the Frontend File Manager Plugin version 23.6 and earlier.
What is CSRF in the context of CVE-2026-16292?
CSRF, or Cross-Site Request Forgery, is a type of attack that tricks a user into executing unwanted actions on a different website where they are authenticated.