CVE-2026-12514 in Shared Files Plugin
Summary
by MITRE • 08/28/2026
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the Shared Files plugin for WordPress prior to version 1.7.67 and its premium counterpart, shared-files-pro before version 1.7.70, represents a critical failure in access control mechanisms within the application's file upload functionality. The core technical flaw lies in the absence of proper capability checks during the execution of the file-upload handler. While WordPress typically relies on nonces to prevent Cross-Site Request Forgery attacks and ensure that requests originate from legitimate user sessions, this implementation incorrectly assumes that a valid nonce is sufficient protection for an operation that should be restricted to authenticated users with specific administrative or author privileges. Because the endpoint is registered as accessible by unauthenticated visitors, any external actor can interact with it provided they can obtain a valid nonce. Since these nonces are generated and output on public-facing pages of the WordPress site, they are trivially discoverable through standard web browsing activities without requiring any form of authentication or prior interaction beyond viewing the page source.
This architectural weakness allows an unauthenticated attacker to upload arbitrary files to directories that are publicly accessible via HTTP requests. The operational impact of this vulnerability is twofold: first, it enables unauthorized data storage on the server, which can lead to disk space exhaustion if large files are uploaded repeatedly in a denial-of-service manner; second, and more critically for information security, the response from the upload handler reveals the absolute file system path of the WordPress installation. This disclosure constitutes an Information Exposure vulnerability where sensitive infrastructure details are leaked to external parties. Knowledge of the server's absolute path is often used by attackers as a precursor step in further exploitation attempts, such as Local File Inclusion attacks or when crafting payloads for other vulnerabilities that require precise knowledge of file system structures.
Although the plugin restricts uploads to MIME types allowed by WordPress core, which effectively prevents the direct upload and execution of PHP scripts through this specific vector, it does not mitigate all risks associated with unauthenticated file uploads. Attackers can still upload malicious content such as HTML files containing cross-site scripting payloads, image files with embedded JavaScript or SVG code that may trigger client-side attacks when viewed in a browser, or other non-executable formats like PDFs or archives that might exploit vulnerabilities in the software used to parse them on the victim's machine. Furthermore, even without direct code execution, the ability to write arbitrary content into publicly accessible directories can be leveraged for defacement campaigns or as part of a broader attack chain involving social engineering if the uploaded files are linked from other parts of the compromised site.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor within the Common Weakness Enumeration framework. In terms of tactical mapping according to the MITRE ATT&CK for Enterprise framework, this behavior corresponds to T1567 Exploit Remote Service as it involves leveraging a service (the WordPress plugin) to gain unauthorized access or perform actions on behalf of an attacker without proper authorization. The lack of server-side validation regarding user roles is a fundamental deviation from secure coding practices where privilege checks must occur before any state-changing operation, regardless of client-side protections like nonces.
To mitigate this vulnerability, site administrators should immediately update the Shared Files plugin to version 1.7.67 or later and shared-files-pro to version 1.7.70 or later, as these versions implement the necessary capability checks to restrict file uploads to authenticated users with appropriate permissions. In environments where updating is not immediately feasible, temporary mitigations include disabling the specific upload endpoint via server-level configuration rules if possible, such as using mod_rewrite in Apache or location blocks in Nginx to deny access to the vulnerable script path for unauthenticated requests. Additionally, implementing strict Content Security Policy headers and monitoring web server logs for unusual file upload activity can help detect exploitation attempts early. Regular security audits focusing on input validation and authorization checks are essential to prevent similar flaws in custom plugins or themes that may follow analogous patterns of relying solely on nonces without verifying user capabilities.