Shared Files CVE-2026-12514

No authentication is required - the CVSS vector is PR:N/AC:L/UI:N, and the upload handler is explicitly registered via the WordPress nopriv AJAX hook, meaning any unauthenticated HTTP client can reach it. The sole prerequisite is that the Shared Files or Shared Files Pro plugin is installed, activated, and running a version prior to 1.7.67 or 1.7.70 respectively, on a publicly reachable WordPress site. No special plugin configuration, specific PHP version, or non-default WordPress setting is required. The critical limiting factor is WordPress's built-in MIME type allowlist: PHP and other server-executable file types are blocked at the platform level, so the vulnerability cannot directly achieve remote code execution - exploitation is bounded to writing non-executable files to a public directory and reading the server's absolute filesystem path from the upload response.

The NVD CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the low-complexity unauthenticated write path but omits the confirmed path-disclosure component, which constitutes a genuine C:L confidentiality impact and brings the independently assessed vector to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. SSVC classifies exploitation as 'none' despite publicly available exploit code existing, which is the strongest limiting signal; however, the Automatable:yes rating means scripted mass scanning is feasible, and even a mid-sized municipal IT team in inowroclaw managing dozens of WordPress sites should treat rapid patching as standard hygiene given zero friction for an attacker. The MIME type restriction preventing PHP execution materially reduces real-world severity compared to a full RCE path - this is a moderate-priority issue, not a critical one. EPSS data was not provided in source intelligence, so numeric exploitation probability cannot be stated.

An attacker visits any public page of a WordPress site running a vulnerable Shared Files version, extracts the nonce value embedded in the page HTML or JavaScript, and submits a crafted multipart POST request to the wp-admin/admin-ajax.php endpoint without a WordPress session cookie. A file within WordPress's allowed MIME types - for example, a PDF containing a phishing payload or a large archive for storage exhaustion - is written to the plugin's publicly accessible upload directory, and the server's absolute filesystem path appears in the JSON response. Publicly available exploit code exists, and the SSVC Automatable:yes rating confirms this flow can be scripted for opportunistic mass scanning against WordPress installations.