CVE-2026-1280

{"id": "CVE-2026-1280", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1280", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T15:55:41.777784Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "nmedia", "product": "Frontend File Manager Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "23.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-28T12:15:52.593", "references": [{"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/callback-functions.php#L98", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/trunk/inc/callback-functions.php#L98", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators only."}, {"lang": "es", "value": "El plugin Frontend File Manager para WordPress es vulnerable al uso compartido de archivos no autorizado debido a una comprobaci\u00f3n de capacidad faltante en la acci\u00f3n AJAX 'wpfm_send_file_in_email' en todas las versiones hasta la 23.5, inclusive. Esto permite a atacantes no autenticados compartir archivos subidos arbitrarios por correo electr\u00f3nico al proporcionar un ID de archivo. Dado que los ID de archivo son enteros secuenciales, los atacantes pueden enumerar todos los archivos subidos en el sitio y exfiltrar datos sensibles que estaban destinados a ser restringidos solo a los administradores."}], "lastModified": "2026-06-17T10:15:26.687", "sourceIdentifier": "security@wordfence.com"}