CVE-2025-13382 is an authorization bypass vulnerability in the Frontend File Manager Plugin for WordPress, caused by insecure direct object reference. The plugin fails to validate ownership of files before allowing rename operations via the '/wpfm/v1/file-rename' REST API endpoint. As a result, authenticated users with Subscriber-level privileges or higher can rename files belonging to other users by manipulating the 'fileid' parameter. This vulnerability affects all versions up to and including 23.4. The CVSS 3.1 base score is 4.3, reflecting low complexity and limited impact on confidentiality and availability.

The vulnerability allows authenticated users with low privileges (Subscriber-level and above) to rename files uploaded by other users, potentially leading to unauthorized modification of file names. This impacts the integrity of user files managed by the plugin but does not disclose file contents or cause denial of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's REST API endpoints or limiting Subscriber-level user capabilities as a temporary mitigation. Monitor vendor communications for updates on patches or official fixes.