Unknown Shared Files Pro vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown Shared Files Pro, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2026-19084unknown · shared-files-pro +1 moreShared Files < 1.7.70 - Unauthenticated Arbitrary File ReadThe shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.EPSS0.32%MediumCVE-2026-12514unknown · shared files +3 moreShared Files < 1.7.70 - Unauthenticated Limited File UploadThe Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.EPSS0.22%CriticalCVE-2026-12513unknown · shared files +3 moreShared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path TraversalThe Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.EPSS0.33%