CVE-2026-5337

During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR) attack. This vulnerability exists because the Frontend File Manager Plugin WordPress plugin through 23.6 does not properly validate user authorization for the requested uploaded file when processing download requests. By modifying the value of the 'file_id' parameter in the download endpoint (e.g., http://localhost/?do=wpfm_download&file_id=40&nm_file_nonce=a36fb893f1), an attacker can access files belonging to other users, including privileged users such as administrators. This allows unauthorized access/read to sensitive data stored within the application.

• CWE-639

• https://wpscan.com/vulnerability/3e28aa78-3227-474a-b1db-1f5ea2c42d14/

Published

May 3, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53364In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53365In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53366In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53367In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53368In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-53369In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-53370In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53371In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53372In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53373In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53374In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53375In the Linux kernel, the following vulnerability has been re…8.8