CVE-2026-0829
published 2026-02-17CVE-2026-0829: The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This…
PriorityP342medium5.8CVSS 3.1
AVNACLPRNUINSCCNILAN
EXPLOIT
EPSS
0.68%
47.8th percentile
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
nuclei·CVSS 5.8
CVE-2026-0829 [MEDIUM] Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.
Template:
id: CVE-2026-0829
info:
name: Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending
author: 0x_Akoko
severity: high
description: |
Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentic
2026-02-17
Published