CVE-2025-14804

Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion

The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server

Affected

Frontend File Manager Plugin

CVSS v3.1 CNA

7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 18th percentile

Published

2026-01-07

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c572c0ad-1b36-49ce-b254-2181e53abb46/

References

• CVE Record
• NVD entry