Shared Files CVE-2026-12513

Exploitation requires two distinct conditions to both be met: first, the attacker must be able to reach and interact with the plugin's frontend file submission form, which is available to unauthenticated users on any site with the plugin installed and frontend submissions enabled (the default configuration). Second, a WordPress administrator must subsequently trigger the permanent-delete action on the malicious file entry - this is the UI:R condition reflected in the CVSS vector and the primary exploitation barrier. The traversal filter bypass itself is the technical prerequisite on the attacker side. Exploitation is limited by: (1) the requirement for administrator interaction at a later point in time, meaning the attacker cannot directly trigger file deletion; (2) AC:H complexity rating, reflecting the non-trivial bypass and timing dependency; and (3) the need for frontend file submissions to be enabled (verify plugin configuration). No authentication is required for the initial injection phase.

The CVSS 3.1 score of 6.8 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) correctly reflects the two-stage nature of this attack: the initial path injection is unauthenticated and network-reachable, but triggering the destructive file deletion requires an administrator to perform a permanent-delete action, hence AC:H and UI:R. These limiting factors substantially reduce opportunistic exploitation potential. SSVC corroborates this: exploitation is rated 'none' and the attack is assessed as not automatable, aligning with the requirement for administrator interaction. Despite PR:N, the need for UI:R means mass exploitation without social engineering or timing-dependent admin behavior is unlikely. The publicly available POC raises the risk floor, but the absence of CISA KEV listing and the non-automatable SSVC rating suggest no confirmed widespread active exploitation. The potential impact is severe - deletion of wp-config.php disables WordPress and exposes database credentials to subsequent attacks - but the dependency on an admin action remains the primary exploitation barrier.

An unauthenticated attacker identifies a WordPress site running the Shared Files plugin, then submits a frontend file entry with a crafted filename containing a traversal sequence that bypasses the single-pass filter (e.g., '....//....//wp-config.php'), causing the plugin to store a resolved path pointing to wp-config.php. When a site administrator later clears file entries through the permanent-delete function - a routine housekeeping action - wp-config.php is deleted from the server, immediately breaking the WordPress installation and potentially exposing database credentials to subsequent attacks. A publicly available POC demonstrates the traversal bypass technique.