CVE-2026-12513
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.68 do not properly sanitize a file path taken from a frontend file submission, and their single-pass traversal filter is bypassable. Unauthenticated users can store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
Risk Assessment
Risk of deletion of critical server files, potentially leading to service unavailability and site takeover.
Recommendation
Update Shared Files to version 1.7.67 or later and Shared Files Pro to 1.7.68 or later. Regularly back up files and database.
Other vulnerabilities in Shared Files
See all- CVE-2026-78269Medium
SSRF vulnerability in Shared Files versions up to 1.7.69, affecting contributor role users. Allows sending requests from the server to internal resources.
- CVE-2026-12514Medium
The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce output on public pages. An unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
- CVE-2026-49112High
Shared Files versions up to 1.7.64 are vulnerable to an unauthenticated Path Traversal attack, allowing an attacker to access system files.
Original NVD description (English source)
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.