CVE-2026-15958
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Easy Integration for Dropbox WordPress plugin before version 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that are also registered for unauthenticated users. This allows an unauthenticated attacker to list, download, and upload arbitrary files on the connected Dropbox account and to read the connected account and administrator email addresses.
Risk Assessment
The vulnerability allows unauthorized access to files and Dropbox account data, and disclosure of email addresses, which can lead to data confidentiality breaches and further attacks.
Recommendation
Update the Easy Integration for Dropbox plugin to version 2.2.0 or later, which includes authorization fixes.
Original NVD description (English source)
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.