The Frontend File Manager Plugin for WordPress through version 23.6 contains an authorization bypass vulnerability (CWE-639) due to improper validation of user authorization when processing file download requests. Authenticated attackers with Subscriber-level privileges can modify the 'file_id' parameter in the download endpoint to access files uploaded by other users, including privileged accounts. This results in unauthorized read access to sensitive data within the application. The vulnerability is classified as an Insecure Direct Object Reference (IDOR). No patch or official remediation has been disclosed as of the publication date.

Exploitation of this vulnerability allows an authenticated user with low privileges to access files uploaded by other users, including administrators, without proper authorization. This leads to unauthorized disclosure of sensitive information stored in the application. There is no impact on data integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user access where possible and monitor for unusual file access patterns. Avoid granting unnecessary upload or download permissions to low-privilege users. Follow vendor updates closely for any forthcoming patches or mitigations.