CVE-2026-12514
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce output on public pages. An unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Risk Assessment
Risk of unauthorized file uploads and disclosure of the server path, which may facilitate further attacks.
Recommendation
Update Shared Files to version 1.7.67 or later and Shared Files Pro to 1.7.70 or later. Restrict access to public pages if possible.
Other vulnerabilities in Shared Files
See all- CVE-2026-78269Medium
SSRF vulnerability in Shared Files versions up to 1.7.69, affecting contributor role users. Allows sending requests from the server to internal resources.
- CVE-2026-12513Medium
The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.68 do not properly sanitize a file path taken from a frontend file submission, and their single-pass traversal filter is bypassable. Unauthenticated users can store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
- CVE-2026-49112High
Shared Files versions up to 1.7.64 are vulnerable to an unauthenticated Path Traversal attack, allowing an attacker to access system files.
Original NVD description (English source)
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.