CVE-2023-7306

Description

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts.

PUBLISHED Reserved 2025-07-24 | Published 2025-07-25 | Updated 2026-04-08 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Matteo Leonelli finder

David Dewes finder

References

www.wordfence.com/...-fa03-4bed-a4ec-b31d36de7633?source=cve

plugins.trac.wordpress.org/...e-uploader/trunk/inc/files.php

cve.org (CVE-2023-7306)

nvd.nist.gov (CVE-2023-7306)

Download JSON