EUVD-2025-209042
GHSA-fwg5-qqw8-5x24
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionNVD
The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector
AnalysisAI
The Shared Files WordPress plugin before version 1.7.58 contains a path traversal vulnerability that allows attackers with Contributor-level privileges or higher to download arbitrary files from the web server, including sensitive configuration files such as wp-config.php. A public proof-of-concept exploit is available, making this vulnerability actively exploitable in the wild. This represents a critical information disclosure risk affecting WordPress installations using affected versions of the plugin.
Technical ContextAI
The vulnerability exploits improper input validation in the Shared Files plugin's file download mechanism, allowing path traversal sequences (such as ../ or absolute paths) to bypass intended directory restrictions. The root cause falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw in file handling logic. The affected product is identified via CPE as cpe:2.3:a:unknown:shared_files:*:*:*:*:*:*:*:*, indicating all versions up to 1.7.57 are vulnerable. The plugin's download handler fails to properly sanitize user-supplied file path parameters before passing them to PHP file system functions, enabling traversal of the server's directory structure. This is particularly dangerous in WordPress environments where wp-config.php contains database credentials and authentication keys.
RemediationAI
Immediately upgrade the Shared Files WordPress plugin to version 1.7.58 or later through the WordPress plugin dashboard or by downloading directly from the official plugin repository. If the plugin cannot be upgraded immediately, disable or remove the plugin entirely to eliminate the attack surface, as this vulnerability can be exploited by any user with Contributor privileges or higher. Conduct a security audit of affected WordPress installations to determine if wp-config.php or other sensitive files have been accessed or downloaded; review server access logs and WordPress user audit trails for suspicious file download activity. Consider implementing network-level controls such as Web Application Firewalls (WAF) with path traversal detection rules to block exploitation attempts during any transition period.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Share
External POC / Exploit Code
Leaving vuln.today