Shared Files Pro CVE-2026-19084

No authentication is required and no special server configuration beyond having the Shared Files Pro plugin installed and activated is needed - the CVSS vector (PR:N/AC:L/UI:N) confirms exploitation against default plugin installations by any remote unauthenticated user. The vulnerable code path is the featured image creation functionality within the plugin, which is exposed without login requirements. Exploitation is constrained to files readable by the web server process user (typically www-data or apache); files with restrictive OS permissions not readable by that process cannot be exfiltrated. Primary high-value targets include wp-config.php (database host, name, username, password, authentication secret keys) and any other world-readable or web-server-readable configuration files. No user interaction is required on the part of any site administrator or visitor.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects a network-accessible, zero-prerequisites information disclosure vulnerability. The publicly available proof-of-concept substantially lowers the expertise barrier and enables opportunistic mass exploitation. SSVC signals present a nuanced picture: 'Exploitation: none' indicates no confirmed active exploitation at time of analysis and no CISA KEV listing, yet 'Automatable: yes' confirms that mass scanning and automated exploitation of this vulnerability are feasible, while 'Technical Impact: partial' appropriately scopes impact to confidentiality with no integrity or availability consequence. The absence of KEV listing should not drive complacency - the combination of no authentication required, confirmed automation feasibility, a public POC, and high-value targets (wp-config.php routinely contains plaintext database credentials and WordPress secret keys) makes this a genuine remediation priority for any site running the affected plugin. The EPSS score was not provided in the input data, so exploitation probability cannot be quantified from that signal.

An unauthenticated attacker sends a crafted HTTP POST request to the Shared Files Pro featured image creation endpoint on any WordPress site running a vulnerable version, supplying a path traversal string (such as ../../wp-config.php) as the file path parameter. The plugin reads the targeted file without validation and publishes its contents at a predictable public URL on the same WordPress site. A publicly available proof-of-concept facilitates scripted mass scanning and automated credential harvesting across large numbers of WordPress installations.