CVE-2025-13382

MEDIUM

Frontend File Manager Plugin <23.4 - Insecure Direct Object Reference

Title source: llm
STIX 2.1

Description

The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 23.4. This is due to the plugin not validating file ownership before processing file rename requests in the '/wpfm/v1/file-rename' REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to rename files uploaded by other users via the 'fileid' parameter.

References (4)

Core 4

Scores

CVSS v3 4.3
EPSS 0.0003
EPSS Percentile 8.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
nmedia/Frontend File Manager Plugin < 23.4
Published Nov 25, 2025
Tracked Since Feb 18, 2026