What is the CVSS score of CVE-2026-15958?

CVE-2026-15958 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Easy Integration for Dropbox are affected by CVE-2026-15958?

WordPress sites using the Easy Integration for Dropbox plugin before version 2.2.0 expose their connected cloud storage to unauthenticated public access, allowing attackers to view, download, and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-15958?

Yes, a public proof-of-concept exploit is available for CVE-2026-15958. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15958?

Within 24 hours: Identify all WordPress instances running Easy Integration for Dropbox plugin versions before 2.2.0 and assess which are connected to production Dropbox accounts. Within 7 days: Upgrade the plugin to version 2.2.0 or later on all affected installations; if immediate patching is not feasible, disable the plugin pending the update. Within 30 days: Confirm all instances have been patched through plugin management verification, review Dropbox account activity logs during the exposure period for unauthorized access, and audit WordPress user activity logs for exploitation attempts.

Easy Integration for Dropbox CVE-2026-15958

EUVD-2026-52590 CRITICAL

Missing Authorization (CWE-862)

2026-08-04 WPScan

GHSA-g948-x7cf-x6p5

WordPress Authentication Bypass Easy Integration For Dropbox Unknown

9.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

10.0 CRITICAL

Unauthenticated network AJAX endpoint (AV:N/AC:L/PR:N/UI:N) impacting a separately-authenticated Dropbox account (S:C) with full read and arbitrary file upload (C:H/I:H); no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:31 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

CRITICAL 9.3

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

Articles & Coverage 1

News Critical Unauthenticated File Access in WordPress Easy Integration for Dropbox - CVE-2026-15958 Aug 05, 2026

AnalysisAI

Unauthenticated arbitrary file access in the Easy Integration for Dropbox WordPress plugin before 2.2.0 lets remote attackers list, download, and upload files across the site's connected Dropbox account and harvest the connected-account and administrator email addresses. Several file-management AJAX actions are registered for logged-out users but skip authorization checks (CWE-862), turning the plugin into an open proxy to the linked cloud storage. Publicly available exploit code exists and a vendor patch is released, though EPSS estimates exploitation probability at only 0.14% (4th percentile).

Technical ContextAI

The plugin bridges a WordPress site to a Dropbox account and exposes file-management operations through WordPress's admin-ajax.php mechanism. In WordPress, AJAX handlers hooked on both wp_ajax_{action} (authenticated) and wp_ajax_nopriv_{action} (unauthenticated) run for anyone unless the callback itself enforces a capability or nonce check. Here the file-management actions were also registered on the nopriv hook and omitted those checks, the classic CWE-862 Missing Authorization root cause. Because the vulnerable code brokers requests to a separately-authenticated Dropbox account, a successful call impacts a security scope beyond the WordPress instance, which is reflected in the CVSS Scope:Changed rating. The CPE cpe:2.3:a:unknown:easy_integration_for_dropbox:*:*:*:*:*:*:*:* covers all versions prior to 2.2.0.

RemediationAI

Upgrade the plugin to Easy Integration for Dropbox 2.2.0 or later, which is the vendor-released fix that adds the missing authorization checks; a patch is confirmed available per the WPScan/EUVD advisory though the input does not enumerate a build beyond the fixed 2.2.0 line. If immediate patching is not possible, the most effective compensating control is to deactivate and remove the plugin until it can be updated, since its unauthenticated endpoints are the exposure. Where the plugin must stay active, disconnect or de-authorize the linked Dropbox account to remove the sensitive target (trade-off: breaks the plugin's core function), and use a WAF or web-server rule to block unauthenticated POSTs to /wp-admin/admin-ajax.php for the plugin's specific file-management action names (trade-off: action-name filtering can be brittle and may need updating). Reference the advisories at https://wpscan.com/vulnerability/e424157e-b79f-4000-8dcc-51413581fdec/ and https://nvd.nist.gov/vuln/detail/CVE-2026-15958. After remediation, rotate the Dropbox connection/API token in case it was abused.