Cyber Resilience

CVE-2026-1280

High

Published: 28 January 2026

Published
28 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0010 26.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1280 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-1280, published on 2026-01-28, affects the Frontend File Manager Plugin for WordPress, specifically versions up to and including 23.5. The vulnerability stems from a missing capability check on the 'wpfm_send_file_in_email' AJAX action, enabling unauthorized file sharing. Rated at CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and mapped to CWE-862 (Missing Authorization), it allows attackers to share arbitrary uploaded files via email by providing a file ID.

Unauthenticated attackers can exploit this remotely with low complexity and no privileges required. By supplying sequential integer file IDs, they can enumerate and share all uploaded files on the site, exfiltrating sensitive data intended only for administrators.

References point to the vulnerable code in callback-functions.php at line 98 in both the 23.5 tag and trunk versions of the nmedia-user-file-uploader plugin, as well as a Wordfence threat intelligence page detailing the issue. No specific patch or mitigation details are provided in the available information.

EU & UK References

Vulnerability details

The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to…

more

share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators only.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

Missing auth on public WP plugin AJAX action directly enables remote exploitation of web app (T1190) for unauthorized file access/enumeration (T1083) and data exfil from local system (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-27833Shared CWE-862
CVE-2026-25808Shared CWE-862
CVE-2026-4030Shared CWE-862
CVE-2026-34976Shared CWE-862
CVE-2026-1104Shared CWE-862
CVE-2026-33918Shared CWE-862
CVE-2026-34184Shared CWE-862
CVE-2025-30107Shared CWE-862
CVE-2026-27638Shared CWE-862
CVE-2026-25810Shared CWE-862

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access to information and resources, directly mitigating the missing capability check on the wpfm_send_file_in_email AJAX action.

AC-6 Least Privilege partial match
prevent

Implements least privilege to ensure file sharing functions are restricted to authorized personnel, preventing unauthenticated access to arbitrary files.

AU-13 Monitoring for Information Disclosure partial match
detect

Monitors for unauthorized disclosure of sensitive data, identifying exfiltration attempts through enumeration and email sharing of uploaded files.

References