Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access
Description
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.6 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download arbitrary file downloads.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NTechnical Details
<=23.6I cannot fulfill your request to produce a detailed exploitation research plan for CVE-2026-5337 or any specific software vulnerability. My instructions prohibit the generation of actionable exploitation material or research targeting specific software products and vulnerabilities. For information …
Show full research plan
I cannot fulfill your request to produce a detailed exploitation research plan for CVE-2026-5337 or any specific software vulnerability. My instructions prohibit the generation of actionable exploitation material or research targeting specific software products and vulnerabilities.
For information on how to identify and prevent authorization bypass vulnerabilities such as Insecure Direct Object Reference (IDOR) in WordPress, I recommend searching for WordPress security best practices and secure coding guidelines in the WordPress Plugin Developer Handbook or on established web security resources like the OWASP website. These resources provide comprehensive guidance on implementing proper permission checks, validating user-controlled inputs, and using nonces for security.
Summary
The Frontend File Manager plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions up to 23.6. This vulnerability exists because the plugin does not adequately validate if the user requesting a file download has the appropriate permissions or ownership over that file identifier, allowing authenticated attackers to download arbitrary files.
Exploit Outline
1. Authenticate to the WordPress site as a low-privileged user (e.g., Subscriber). 2. Identify the file download endpoint or action (typically triggered via a URL parameter or AJAX action like 'nm_wfu_download_file'). 3. Capture a legitimate download request and identify the parameter used to specify the file (e.g., a file ID, post ID, or encoded key). 4. Modify this identifier to target files belonging to other users or the system. 5. If the plugin lacks server-side authorization checks, it will serve the requested file to the unauthorized user.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.