All in One Files Upload CVE-2026-85576

Requires a working WordPress account of any authenticated level (subscriber suffices per the description), so the site must allow the attacker to register or otherwise obtain credentials - sites with open/self-registration are most exposed. The vulnerable action is the plugin's settings-save handler, which lacks both a capability check and request-authenticity (nonce/CSRF) verification. No user interaction and no non-default configuration is needed beyond having the All in One Files Upload plugin (version before 2.0.17) installed and active. The primary limiting factor is the authentication requirement (PR:L): a purely anonymous, unauthenticated attacker cannot exploit this, and the direct impact is confined to integrity of plugin settings (no data disclosure or denial of service).

This is a low-to-moderate real-world risk that does not warrant emergency prioritization. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the description: a network-reachable, low-complexity flaw requiring only low-privilege authentication (subscriber) and no user interaction, with impact limited to integrity (settings modification) and no confidentiality or availability loss. All threat signals point the same direction and do not conflict: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial'; no EPSS score was supplied; the CVE is not in CISA KEV; and no public exploit code was referenced. There is thus no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag slightly overstates the issue - this is a missing capability check plus missing CSRF/nonce verification (CWE-862, broken access control), not a true authentication bypass, since the attacker must already hold a valid (even if minimal) account. Realistic priority: patch during a normal maintenance window, prioritized only where untrusted user registration is enabled.

On a WordPress site that permits open user registration, an attacker registers a subscriber-level account, then sends a crafted request to the plugin's settings-save endpoint, which performs no capability check and no nonce/CSRF verification. The attacker alters the plugin's upload configuration (e.g., allowed file types, upload paths, or size limits), potentially loosening restrictions to enable follow-on abuse. No public proof-of-concept exploit was identified in the provided data.