Authenticated attackers with Subscriber-level access or higher in the Frontend File Manager Plugin for WordPress (up to version 23.6) can exploit an Insecure Direct Object Reference (IDOR) vulnerability. By manipulating the 'file_id' parameter in download requests, they can access files uploaded by other users, including those belonging to administrators, leading to unauthorized disclosure of sensitive data.