Unknown Shared Files vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Shared Files, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.8CVE-2025-15433unknownshared files+1
EPSS score
0.43%
The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector5.3CVE-2026-12514unknownshared files+3
EPSS score
0.22%
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.9.1CVE-2026-12513unknownshared files+3
EPSS score
0.33%
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.7.2CVE-2023-4819tammersoftshared_files+2
EPSS score
0.49%
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.