EUVD-2026-64834
GHSA-fmxw-fw8j-h734
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-reachable via WordPress, low complexity; PR:L reflects mandatory Contributor authentication; S:C captures SSRF reaching beyond the application boundary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
AnalysisAI
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum the Contributor role (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 6.4 (Medium) is calibrated by PR:L, meaning exploitation requires a valid WordPress account with at least Contributor privileges - a meaningful but not high bar on sites that allow open registration or have multiple contributors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or registered a WordPress Contributor account on a vulnerable site crafts a request to the Shared Files plugin feature that accepts user-supplied URLs, substituting a target such as http://169.254.169.254/latest/meta-data/ (AWS IMDSv1 metadata endpoint). The server fetches the URL and returns internal cloud metadata - potentially including IAM role credentials - to the attacker. … |
| Remediation | The primary remediation is to update the Shared Files plugin to a version above 1.7.69. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Shared Files
View allThe Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which c
The Easy Download Manager and File Sharing Plugin with frontend file upload - a better Media Library - Shared Files Word
Unauthenticated path traversal in the Shared Files WordPress plugin (versions 1.7.64 and earlier) allows remote attacker
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today