Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR) attack. This vulnerability exists because the Frontend File Manager Plugin WordPress plugin through 23.6 does not properly validate user authorization for the requested uploaded file when processing download requests. By modifying the value of the 'file_id' parameter in the download endpoint (e.g., http://localhost/?do=wpfm_download&file_id=40&nm_file_nonce=a36fb893f1), an attacker can access files belonging to other users, including privileged users such as administrators. This allows unauthorized access/read to sensitive data stored within the application.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-5337 During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR… https://www.cve.org/CVERecord?id=CVE-2026-5337
Post summary
The text reports CVE-2026-5337 as an IDOR flaw that can be exploited by authenticated users with subscriber-level access or higher.
🚨*CVE* CVE-2026-5337 During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR… https://www.cve.org/CVERecord?id=CVE-2026-5337 ----- Traducción: CVE-2026-5337 Dur… http://infoflow.cloud`
Post summary
The text announces CVE-2026-5337, outlining an IDOR that impacts authenticated users with Subscriber access or higher, but it does not provide exploit code, patches, or evidence of active exploitation.
CVE-2026-5337 Insecure Direct Object Reference in Frontend File Manager Plugin WordPress Through 23.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5337
Post summary
The entry merely announces an Insecure Direct Object Reference (IDOR) vulnerability (CVE‑2026‑5337) in the Frontend File Manager WordPress plugin, without providing PoC, exploit, patch, or usage details.