The Frontend File Manager Plugin WordPress plugin through version 23.6 does not validate nonces on one of its file-metadata update actions. This lack of nonce validation allows an attacker to perform a CSRF attack to modify metadata of files uploaded by logged-in users. When guest uploads are enabled, the vulnerability can be exploited unauthenticated against any user's file. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impact.

An attacker can modify metadata of files uploaded by authenticated users via CSRF, potentially enabling unauthorized download of those files. When guest uploads are enabled, the vulnerability can be exploited without authentication against any user's files. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling guest uploads if enabled to reduce exposure. Monitor official Frontend File Manager Plugin advisories for updates and apply any released patches promptly.