Description
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Frontend File Manager Plugin | ≤ 23.5 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending http/cves/2026/CVE-2026-0829.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225/ exploit vdb-entry technical-description