CVE-2026-8095 is an authenticated arbitrary file deletion vulnerability in the Frontend File Manager Plugin for WordPress. The issue arises from a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler. By supplying the parameter name in uppercase (WPFM_DIR_PATH), the plugin bypasses an unset check and then normalizes the parameter to wpfm_dir_path during update_post_meta(). This allows an attacker to overwrite the stored file path with an arbitrary filesystem path, which is then passed directly to the unlink() function in delete_file_locally() without directory containment validation. Consequently, an authenticated attacker with minimal privileges (Subscriber-level) can delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to full site compromise.

An attacker with Subscriber-level access can delete arbitrary files on the server, including sensitive WordPress configuration files. This can disrupt website functionality and potentially enable full site takeover by removing critical files or triggering further exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict Subscriber-level access and monitor for suspicious activity related to file deletion. Avoid granting unnecessary privileges to low-level users.