CVE-2025-15433

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector

Score

CVSS 3.1 6.8 Medium

Status

Deferred - contact@wpscan.com

Published

2026-03-26

Last modified

2026-03-26

Affected products

• Shared Files (Unknown)

References

• https://wpscan.com/vulnerability/893667a1-dc8f-476a-ac00-55752fface90/