Description

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-28T08:16:40.083Z",
  "pubdate": "2026-08-28T08:16:40.083Z",
  "executiveSummary": "The Shared Files and Shared Files Pro WordPress plugins are susceptible to an arbitrary file deletion vulnerability resulting from improper input sanitization during file submission processes. This vulnerability is classified as a Path Traversal issue, allowing an unauthenticated attacker to manipulate file path parameters.\nBy providing a crafted path that bypasses the plugin's single-pass traversal filter, an attacker can designate critical system files—such as wp-config.php—as targets for deletion. The vulnerability is triggered during the file entry deletion cycle, where the application fails to validate the scope of the file path against the intended upload directory.\nThe impact of this flaw is severe, potentially resulting in a complete Denial of Service (DoS) and opening vectors for full site takeover if the configuration file is removed, subsequently forcing a site reinstallation or allowing the attacker to reconfigure database credentials. Affected versions include Shared Files before 1.7.67 and Shared Files Pro before 1.7.68. There are no authentication requirements to initiate this attack, making it reachable by remote, unauthenticated threat actors.\nOrganizations using these plugins are at high risk until the software is updated to the patched versions.",
  "technicalDetails": "The vulnerability originates from a flawed implementation of path sanitization within the frontend file submission logic of the Shared Files and Shared Files Pro plugins. The application employs a single-pass traversal filter to sanitize user-supplied file paths; however, this mechanism is insufficient to prevent directory traversal sequences (e.g., ../) from being processed if they are concatenated or nested in a manner that the filter does not recursively evaluate.\nThe attack flow begins when an unauthenticated user submits a file path via the frontend interface. By utilizing traversal sequences, an attacker can input a path that points outside the designated WordPress uploads directory and toward sensitive system files. Because the input validation logic is applied only once, an attacker can supply a specially crafted path string that evades detection, storing an arbitrary reference within the plugin's database entry for the submitted file.\nThe exploit reaches fruition when the attacker performs an action—or triggers a system process—that results in the permanent deletion of the stored file entry. When the plugin processes this deletion request, it utilizes the malicious path stored in the database. Crucially, the plugin fails to perform secondary validation or check the filesystem boundaries (such as a chroot or realpath verification) before executing the file deletion command on the server-side filesystem.\nBy targeting 'wp-config.php', an attacker can force the WordPress application to become non-functional. Since 'wp-config.php' contains essential database connection strings and security keys, its deletion renders the site unreachable, effectively causing a DoS condition. Furthermore, in many hosting environments, the absence of this file permits the initiation of the WordPress installation wizard, potentially allowing an attacker to re-initialize the database with their own credentials, leading to total site compromise and administrative takeover.\nThis vulnerability is particularly dangerous due to its lack of authentication requirements and the ability to operate directly through the plugin's standard file handling functionality. The root cause is the reliance on incomplete blacklisting/sanitization logic rather than secure path normalization and directory restriction primitives, such as utilizing the 'wp_normalize_path' function and verifying that the target file path resides within the authorized 'wp-content/uploads' directory."
}