CVE-2026-8379
Last modified
CVE-2026-8379 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.
Metrics
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-8379?
How severe is CVE-2026-8379?
How do I fix CVE-2026-8379?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-83743A weakness has been identified in invoiceninja Invoice Ninja…6.3
- CVE-2026-83744A security vulnerability has been detected in invoiceninja I…4.3
- CVE-2026-8376Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-R…9.8
- CVE-2026-8377Missing Authorization vulnerability in Armiya Information Te…8.2
- CVE-2026-83772A vulnerability was detected in Cobham SATCOM VSAT7090 Marit…9.9
- CVE-2026-8378The Frontend File Manager Plugin WordPress plugin through 23…5.4
- CVE-2026-8380The Frontend File Manager Plugin WordPress plugin through 23…6.5
- CVE-2026-83801Nautobot is a Network Source of Truth and Network Automation…5.4
- CVE-2026-83803Sentry is an error tracking and performance monitoring tool.…7.7
- CVE-2026-83805Nautobot is a Network Source of Truth and Network Automation…6.4
- CVE-2026-8381A broken access control vulnerability exists in the TeamView…5.4
- CVE-2026-8382The Advanced Custom Fields (ACF®) plugin for WordPress is vu…5.3
Are you affected by CVE-2026-8379?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST