A critical authorization bypass vulnerability in the nmedia Frontend File Manager Plugin allows unauthenticated attackers to exfiltrate sensitive files, posing a severe risk to data confidentiality.

This vulnerability stems from a missing capability check on the wpfm_send_file_in_email AJAX action, which permits unauthenticated users to trigger the file sharing mechanism. Because file IDs are sequential integers, an attacker can enumerate and email themselves any file stored within the plugin managed directory.

The ability for an unauthenticated attacker to exfiltrate files intended for administrative eyes only constitutes a significant breach of confidentiality. Given the CVSS score of 7.5, this high-severity flaw could lead to the exposure of sensitive user data, proprietary information, or configuration files, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: Since no patched version is currently confirmed, administrators should immediately deactivate and uninstall the Frontend File Manager Plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to the AJAX endpoint or frequent sequential access patterns associated with file ID enumeration.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the affected AJAX action or restrict access to the plugin directory to known administrative IP addresses.

Public Exploit Available: Unknown.

The risk posed by this vulnerability is significant due to the lack of required authentication and the potential for automated data exfiltration. Organizations currently utilizing this plugin must prioritize its removal or restriction until the vendor provides a formal security update to address the missing authorization check.