Shared Files Pro
Monthly
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.
Unauthenticated arbitrary file read in the Shared Files Pro WordPress plugin (all versions before 1.7.70) allows remote attackers to supply an unvalidated path parameter during featured image creation, causing the plugin to read and republish any file accessible to the web server process at a public URL. This compound impact - read plus republication - means sensitive data such as wp-config.php database credentials or secret keys can be exfiltrated and exposed to any internet user, not just the attacker. A publicly available proof-of-concept exists, and the CVSS vector confirms no authentication or user interaction is required against any default installation of the affected plugin.
Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.
Arbitrary file deletion via path traversal in the Shared Files and Shared Files Pro WordPress plugins (versions before 1.7.67 and 1.7.68 respectively) enables unauthenticated attackers to trigger deletion of critical server files such as wp-config.php, causing denial of service and potential site takeover. The plugin's single-pass traversal filter is bypassable during frontend file submission, allowing a crafted path pointing outside the uploads directory to be stored; when an administrator later permanently deletes the corresponding file entry, the resolved arbitrary file is removed. A publicly available proof-of-concept exists, though SSVC assessment rates exploitation as none at time of analysis, likely reflecting the two-stage attack dependency on administrator action.