WP Cloud Plugins EUVD-2026-83414

Requires one of the four affected WP Cloud Plugins (Use-your-Drive, Out-of-the-Box/Dropbox, Share-one-Drive/OneDrive-SharePoint, or Lets-Box/Box) installed and active at version 2.0 through 3.8.3 on a target WordPress site. Per the CVSS vector (PR:L), the attacker needs at least subscriber-level authentication - realistic on sites with open user registration enabled - and reaches the vulnerable download_file_to_uploads code path through the import AJAX action. The description additionally states the action is hooked via wp_ajax_nopriv_ with no capability check in can_import(), which suggests the write may be reachable without authentication; if confirmed, the subscriber-level prerequisite would not limit exploitation. No user interaction is required (UI:N). Limiting factors: the specific plugin must be installed, and successful RCE depends on the uploads directory permitting PHP execution (many hardened hosts disable PHP in wp-content/uploads, downgrading impact to arbitrary file write/stored content).

This is a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity arbitrary file upload leading to remote code execution, gated only by subscriber-level authentication - a trivially obtainable privilege on any WordPress site allowing open registration. My independent assessment agrees with the vendor 8.8; the only reason it is not 9.8 is the PR:L gate. Notably, the description itself flags a tension worth verifying: it states the import action is 'registered for unauthenticated users via wp_ajax_nopriv_' with 'a missing capability check in can_import()', which would imply PR:N (unauthenticated) exploitation, yet Wordfence's CVSS assigns PR:L (subscriber-and-above). This conflict should be verified with the vendor/Wordfence advisory - if the nopriv path is truly reachable without a valid session, real-world risk is higher than the 8.8 implies. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation is not confirmed as active; however, unauthenticated-or-low-priv RCE in popular WordPress plugins is a class that is routinely mass-scanned and weaponized quickly after disclosure, so the absence of a POC signal should not be read as low urgency. Patch (v3.9.0) availability is indicated by the changelog references.

An attacker registers a subscriber account (or exploits the wp_ajax_nopriv_ registration path if reachable without auth) on a WordPress site running a vulnerable version of Use-your-Drive, Out-of-the-Box, Share-one-Drive, or Lets-Box, then invokes the import action to call download_file_to_uploads and write a PHP web shell into the uploads directory, bypassing the missing can_import() capability check and the absent mime-type/extension validation. They then request the uploaded file directly to execute arbitrary PHP as the web server, achieving full site compromise. No public exploit code was identified at time of analysis, but the low attack complexity makes reliable exploitation straightforward.