CVE-2026-1280

The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators only.

• CWE-862

• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/tags/23.5/inc/callback-functions.php#L98
• https://plugins.trac.wordpress.org/browser/nmedia-user-file-uploader/trunk/inc/callback-functions.php#L98
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033?source=cve

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1279The Employee Directory plugin for WordPress is vulnerable to…6.4
• CVE-2026-12795A vulnerability was determined in BerriAI litellm up to 1.82…7.3
• CVE-2026-12796A vulnerability was identified in BerriAI litellm up to 1.82…6.3
• CVE-2026-12797A security flaw has been discovered in BerriAI litellm up to…6.3
• CVE-2026-12798A weakness has been identified in BerriAI litellm up to 1.82…6.3
• CVE-2026-12799A security vulnerability has been detected in BerriAI litell…4.3
• CVE-2026-12800The Premium Packages – Sell Digital Products Securely plugin…7.5
• CVE-2026-12801The Ultra Addons for Contact Form 7 plugin for WordPress is …6.4
• CVE-2026-12802In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData…8.7
• CVE-2026-12803In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC d…8.7
• CVE-2026-12804A vulnerability was detected in lemonldap-ng up to 2.23.0. I…4.3
• CVE-2026-12805A flaw has been found in OFFIS DCMTK up to 3.7.0. The affect…6.3