CVE-2026-8380 is a vulnerability in the Frontend File Manager Plugin for WordPress (up to version 23.6) where the plugin fails to verify ownership of targeted posts before allowing permanent deletion. Authenticated users with author-level permissions or higher can exploit this to delete arbitrary posts and pages. Furthermore, when the "Allow guest uploads" setting is enabled by an administrator, unauthenticated users can also trigger this deletion functionality. The issue is categorized under CWE-73 (External Control of File Name or Path). No CVSS score or patch information is currently available.

Exploitation of this vulnerability allows unauthorized permanent deletion of posts and pages. Authenticated users with author-level access can delete arbitrary content, potentially leading to data loss or disruption of website content. If guest uploads are enabled, unauthenticated users can also perform these deletions, increasing the risk of abuse and unauthorized content removal.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the "Allow guest uploads" setting to prevent unauthenticated users from exploiting this vulnerability. Additionally, review user permissions to limit author-level access where possible.