Back
CVE-2026-0829
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Medium5.8EPSS 0.74%
- Published
- Updated
- Reserved
- Assigned by
- WPScan
Description
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| NVDNVD · Deferred | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
- CWE-862 Missing Authorization
- CWE-862 Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs
Affected products
Unknown · Frontend File Manager Plugin
- affected ≤ 23.5
References (1)
- https://wpscan.com/vulnerability/57d62cea-cfb8-4421-a209-e64a015ad225/ (opens in a new tab)exploitvdb-entrytechnical-description
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-0829)Record last updated .