CVE-2026-1280: 
WordPress vulnerability analysis and mitigation

CVE-2026-1280 is a missing authorization vulnerability in the Frontend File Manager Plugin for WordPress (by nmedia/najeebmedia) that allows unauthenticated attackers to share arbitrary uploaded files via email. The flaw exists in all plugin versions up to and including 23.5, affecting the wpfm_send_file_in_email AJAX action. It was published on January 28, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Wordfence).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the wpfm_send_file_in_email AJAX action registered by the plugin. Because no authentication or permission verification is enforced before processing the request, any unauthenticated network attacker can invoke this action by supplying a numeric file ID. File IDs are sequential integers, making it trivial to enumerate all uploaded files on the site through iteration. The vulnerable code is visible in the plugin's source at inc/callback-functions.php around line 98 (Wordfence, Plugin Source).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact. Unauthenticated attackers can exfiltrate sensitive files uploaded to the WordPress site — including files intended to be accessible only to administrators — by having them delivered to an attacker-controlled email address. This could expose personally identifiable information (PII), business documents, or other restricted data stored via the plugin (Red Hat CVE, Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.04%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity — requiring no authentication, no user interaction, and only a simple HTTP request with an enumerable integer file ID — makes it straightforward to exploit if targeted (Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running the Frontend File Manager Plugin (nmedia-user-file-uploader) version ≤23.5 using tools like WPScan, Shodan, or by checking the plugin's readme.txt at https://target.com/wp-content/plugins/nmedia-user-file-uploader/readme.txt.
2. Identify the AJAX endpoint: The vulnerable action is registered as a WordPress AJAX handler. The target endpoint is https://target.com/wp-admin/admin-ajax.php.
3. Craft the malicious request: Send an unauthenticated HTTP POST request to the AJAX endpoint with the parameters action=wpfm_send_file_in_email, a target email address controlled by the attacker, and a numeric file_id (e.g., file_id=1).
4. Enumerate file IDs: Iterate the file_id parameter sequentially (1, 2, 3, …) to trigger email delivery of all uploaded files, since IDs are sequential integers with no access control enforced.
5. Collect exfiltrated files: Retrieve the files delivered to the attacker-controlled email address, potentially exposing sensitive documents, PII, or administrative data (Wordfence, Plugin Source).

• Network: High volume of HTTP POST requests to /wp-admin/admin-ajax.php with action=wpfm_send_file_in_email from a single or rotating IP address, especially with sequentially incrementing file_id values.
• Logs: WordPress access logs showing repeated unauthenticated AJAX calls to admin-ajax.php with the wpfm_send_file_in_email action parameter; outbound SMTP traffic spikes corresponding to file-sharing email delivery.
• Email Server: Unusual volume of outbound emails originating from the WordPress site's mail system, directed to external or unknown addresses, each containing file attachments from the upload directory.

Users should update the Frontend File Manager Plugin to a version beyond 23.5 that includes a proper capability check on the wpfm_send_file_in_email AJAX action. If an immediate update is not possible, site administrators can temporarily disable the plugin or use a Web Application Firewall (WAF) rule to block unauthenticated POST requests to admin-ajax.php with the action=wpfm_send_file_in_email parameter. Administrators should also audit their uploaded files for sensitive content and review outbound email logs for signs of prior exploitation (Wordfence).

Wordfence included CVE-2026-1280 in their weekly WordPress vulnerability report for the period of January 26 – February 1, 2026, highlighting it as a notable missing authorization issue (Wordfence Weekly Report). The vulnerability was also picked up by automated security feeds including RedPacket Security and TheHackerWire, and noted by Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT. Community reaction has been limited to standard vulnerability tracking and alerting, with no significant researcher commentary or major media coverage beyond routine disclosure channels.