Description

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T08:16:40.230Z",
  "pubdate": "2026-08-28T08:16:40.230Z",
  "executiveSummary": "The Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins are susceptible to an unauthenticated arbitrary file upload vulnerability.\nThe vulnerability arises from a missing capability check in the file-upload handler, which is exposed to unauthenticated users.\nWhile the mechanism relies on a nonce, this nonce is readily available on public-facing pages, effectively bypassing the intended security control.\nSuccessful exploitation permits unauthorized visitors to upload files to a publicly accessible directory on the server.\nBeyond the risk of resource exhaustion or unauthorized data hosting, the vulnerability discloses the server's absolute filesystem path in the response, facilitating further reconnaissance.\nAlthough the plugin enforces restrictions based on WordPress-allowed MIME types—preventing the execution of malicious PHP scripts—the vulnerability remains critical due to the potential for data exfiltration, storage of malicious payloads, or bypassing filesystem access controls.\nRemediation requires immediate updates to the patched versions of the respective plugins.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient access control implementation within the file-upload handler of the Shared Files and Shared Files Pro WordPress plugins. The handler is designed to process file uploads, but it fails to invoke the necessary WordPress capability checks (e.g., current_user_can()) that would restrict the operation to authorized administrative or contributor roles.\nThe plugin attempts to secure this endpoint using a nonce; however, this security measure is fundamentally flawed because the nonce value is rendered directly on public pages. An unauthenticated attacker can retrieve this nonce via a simple HTTP GET request to any public page where the plugin is active, and subsequently use it to authorize a POST request to the file-upload endpoint.\nThe attack flow proceeds as follows: First, the attacker performs reconnaissance to extract the required nonce from the HTML source of a public page. Second, the attacker crafts a multipart/form-data request containing the target file, incorporating the extracted nonce to bypass the handler's validation logic. Third, the plugin, failing to verify the user's role or permissions, processes the request and saves the file to a publicly accessible directory on the server.\nUpon successful upload, the server returns a response containing the absolute filesystem path of the uploaded file. This disclosure provides attackers with sensitive path information, which is valuable for further exploitation or mapping the server environment.\nThe technical constraints include the plugin's enforcement of WordPress MIME type filtering. Because the upload process is limited to standard, non-executable formats (e.g., images, documents), a direct remote code execution (RCE) via PHP injection is not achievable in the default configuration. However, the ability to write arbitrary files to the webroot allows an attacker to host malicious content, such as phishing pages, malware, or illicit data, leveraging the trust associated with the legitimate domain.\nAffected versions include Shared Files prior to 1.7.67 and Shared Files Pro prior to 1.7.70. This vulnerability is exposed over the network to any unauthenticated user with access to the web server, representing a significant failure in endpoint authorization and server integrity maintenance."
}