Shared Files
Monthly
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.
Unauthenticated path traversal in the Shared Files WordPress plugin (versions 1.7.64 and earlier) allows remote attackers to read arbitrary files outside the plugin's intended directory scope on the underlying WordPress host. The flaw is reachable without authentication over the network and carries a CVSS 7.5 with high confidentiality impact, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Disclosed by Patchstack, the bug primarily threatens sensitive files such as wp-config.php and other server-side secrets accessible to the web user.
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Easy Download Manager and File Sharing Plugin with frontend file upload - a better Media Library - Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.
Unauthenticated path traversal in the Shared Files WordPress plugin (versions 1.7.64 and earlier) allows remote attackers to read arbitrary files outside the plugin's intended directory scope on the underlying WordPress host. The flaw is reachable without authentication over the network and carries a CVSS 7.5 with high confidentiality impact, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Disclosed by Patchstack, the bug primarily threatens sensitive files such as wp-config.php and other server-side secrets accessible to the web user.
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Easy Download Manager and File Sharing Plugin with frontend file upload - a better Media Library - Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.