Frontend File Manager & Sharing – User Private Files <= 1.1.1 - Missing Authorization

The Frontend File Manager & Sharing – User Private Files plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.1.1. This is due to missing capability checks and nonce validation on several functions such as dpk_upvf_rmv_file(), dpk_upvf_rmv_access(), and dpk_upvf_update_doc(). This makes it possible for unauthenticated attackers to modify several settings and modify files (via deletion and settings updates).