CVE-2026-8095 is an authenticated arbitrary file deletion vulnerability in the nmedia Frontend File Manager Plugin for WordPress (<=23.6). The issue arises from a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler. By supplying the parameter name in uppercase (WPFM_DIR_PATH), the plugin's unset check is bypassed. The sanitize_key() function then normalizes this to wpfm_dir_path during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path. This path is passed directly to the unlink() function in delete_file_locally() without directory containment validation, enabling deletion of arbitrary files. Attackers with Subscriber-level privileges can exploit this to delete sensitive files such as wp-config.php, risking full site compromise.

An attacker with authenticated Subscriber-level access can delete arbitrary files on the server hosting the WordPress site. This includes critical files like wp-config.php, which can lead to denial of service or full site takeover. The vulnerability does not require user interaction and has a low attack complexity. It impacts the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access and monitor for suspicious activity related to file deletion. Avoid using the vulnerable plugin version (<=23.6) in production environments if possible.