CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-28

Last modified

2026-08-28

Weaknesses

CWE-862

Affected products

• Shared-files-pro (Unknown)
• Shared Files (Unknown)

References

• https://wpscan.com/vulnerability/a3098be8-aa7a-48ef-9fcc-b67c763debba/