Description

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:40.513Z",
  "pubdate": "2026-08-28T08:16:40.513Z",
  "executiveSummary": "The shared-files-pro WordPress plugin, in versions prior to 1.7.70, contains a critical security flaw involving improper validation of file path inputs during the featured image creation process. This vulnerability allows an unauthenticated attacker to perform arbitrary file reads from the underlying server filesystem. By manipulating the path parameter, an attacker can bypass access controls to access sensitive server-side files, including configuration files, credentials, or system data. Once accessed, these files can be republished to a public-facing URL, leading to significant information disclosure. Given that this exploit requires no authentication or specific user privileges, it represents a high-risk scenario for any WordPress installation utilizing affected versions of the plugin. The ability to exfiltrate arbitrary files could potentially lead to full system compromise or facilitate further attacks by exposing environment-specific secrets.",
  "technicalDetails": "The vulnerability resides in the featured image handling mechanism within the shared-files-pro plugin. The root cause is a failure to implement proper path normalization, input sanitization, or filesystem access validation when processing the file path supplied by a user. Specifically, the plugin fails to verify whether the requested file resides within an intended or safe directory, effectively permitting directory traversal and absolute path traversal attacks.\nExploitation is straightforward and does not require the attacker to have an active session or specific administrative privileges. An unauthenticated attacker can supply a crafted file path to the vulnerable endpoint responsible for featured image assignment. When the plugin processes this input, it fails to constrain the file read operations to authorized media directories. Consequently, the application interprets the malicious input as a legitimate path and attempts to access the file from the server's root or other restricted directories.\nThe attack flow follows a predictable pattern: first, the attacker identifies the parameter responsible for the file path input in the featured image creation request. Second, the attacker crafts a payload—typically utilizing dot-dot-slash (../) sequences or absolute file paths—to target a specific sensitive file, such as wp-config.php or sensitive system files (e.g., /etc/passwd). Third, upon submitting this payload, the plugin processes the request and interacts with the filesystem using the attacker-supplied path. Finally, the application returns or republishes the content of the accessed file, making it accessible to the attacker through a public URL. This process effectively converts the plugin into a proxy for arbitrary file retrieval, allowing for the systematic exfiltration of sensitive server data. The lack of authentication checks at this vector ensures that the exploit can be launched remotely over a network by any actor capable of interacting with the plugin's endpoints."
}