CVE-2026-12277 is a vulnerability in the Frontend File Manager Plugin for WordPress (versions up to 23.6) where the plugin fails to validate user-supplied file paths before deleting files. This lack of validation allows unauthenticated attackers to delete arbitrary files on the server if guest upload mode is enabled. Deletion of sensitive files like wp-config.php can disrupt site configuration and may be leveraged for complete site compromise. The vulnerability is categorized under CWE-73 (External Control of File Name or Path). The CVSS v3.1 base score is 8.7, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts integrity and availability.

An attacker can delete arbitrary files on the server without authentication, including critical configuration files such as wp-config.php. This can force the WordPress site into its setup routine, potentially allowing the attacker to take full control of the site. The integrity and availability of the affected system are severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable guest upload mode to prevent unauthenticated file deletions. Monitor vendor channels for updates and apply patches promptly once available.