CVE-2026-85576
MediumCVSS 4.3Summary
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings. This allows any authenticated user, such as a subscriber, to change them.
Risk Assessment
Unauthorized modification of plugin settings can lead to weakened security or disruption of site functionality.
Recommendation
Update the All in One Files Upload plugin to version 2.0.17 or later to add capability checks and request verification.
Other vulnerabilities in All in One Files Upload
Original NVD description (English source)
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS