EUVD-2025-209042
GHSA-fwg5-qqw8-5x24
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector
AnalysisAI
The Shared Files WordPress plugin before version 1.7.58 contains a path traversal vulnerability that allows attackers with Contributor-level privileges or higher to download arbitrary files from the web server, including sensitive configuration files such as wp-config.php. A public proof-of-concept exploit is available, making this vulnerability actively exploitable in the wild. This represents a critical information disclosure risk affecting WordPress installations using affected versions of the plugin.
Technical ContextAI
The vulnerability exploits improper input validation in the Shared Files plugin's file download mechanism, allowing path traversal sequences (such as ../ or absolute paths) to bypass intended directory restrictions. The root cause falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw in file handling logic. The affected product is identified via CPE as cpe:2.3:a:unknown:shared_files:*:*:*:*:*:*:*:*, indicating all versions up to 1.7.57 are vulnerable. The plugin's download handler fails to properly sanitize user-supplied file path parameters before passing them to PHP file system functions, enabling traversal of the server's directory structure. This is particularly dangerous in WordPress environments where wp-config.php contains database credentials and authentication keys.
RemediationAI
Immediately upgrade the Shared Files WordPress plugin to version 1.7.58 or later through the WordPress plugin dashboard or by downloading directly from the official plugin repository. If the plugin cannot be upgraded immediately, disable or remove the plugin entirely to eliminate the attack surface, as this vulnerability can be exploited by any user with Contributor privileges or higher. Conduct a security audit of affected WordPress installations to determine if wp-config.php or other sensitive files have been accessed or downloaded; review server access logs and WordPress user audit trails for suspicious file download activity. Consider implementing network-level controls such as Web Application Firewalls (WAF) with path traversal detection rules to block exploitation attempts during any transition period.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today