CVE-2025-64265

MediumCVSS 4.3

Published: 13/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Frontend File Manager plugin for WordPress (nmedia-user-file-uploader) contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 23.2.

Risk Assessment

An unauthorized user may gain access to file management features, potentially leading to unauthorized file operations or privilege escalation.

Recommendation

Update the plugin to the latest version if available, and review access permission settings to ensure only authorized users have access to file management functions.

Other vulnerabilities in Frontend File Manager

CVE-2026-32577High
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager versions up to 23.6.

Original NVD description (English source)

Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS