Shared Files vulnerabilities

SSRF vulnerability in Shared Files versions up to 1.7.69, affecting contributor role users. Allows sending requests from the server to internal resources.

The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce output on public pages. An unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.

The Shared Files WordPress plugin before 1.7.67 and Shared Files Pro before 1.7.68 do not properly sanitize a file path taken from a frontend file submission, and their single-pass traversal filter is bypassable. Unauthenticated users can store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.

Shared Files versions up to 1.7.64 are vulnerable to an unauthenticated Path Traversal attack, allowing an attacker to access system files.