CVE-2026-93031 in Lets-Box Plugin
Summary
by MITRE • 09/18/2026
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The identified vulnerability affects a suite of WordPress plugins including WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box across versions 2.0 through 3.8.3. This security flaw is classified as an Arbitrary File Upload vulnerability, which represents one of the most critical risks in web application security due to its direct potential for system compromise. The root cause lies within the implementation of the download_file_to_uploads function, where the import action is registered using the wp_ajax_nopriv_ hook mechanism. This registration allows unauthenticated users to trigger specific administrative or privileged actions without proper authentication checks at the entry point level, although in this specific context, it facilitates a path for authenticated attackers with subscriber-level access and above to exploit subsequent logic flaws.
The technical core of the vulnerability stems from two distinct failures in input validation and authorization controls. First, there is a missing capability check within the can_import function. In WordPress architecture, functions handling sensitive operations must verify that the current user possesses the necessary capabilities or roles before proceeding with execution. The absence of this check means that users with minimal privileges, such as subscribers, are granted access to functionality intended for higher-privileged accounts like administrators or editors. Second, and more critically, the plugin fails to validate the extension and contents of imported files against WordPress's get_allowed_mime_types configuration. This oversight allows attackers to bypass standard file type restrictions by uploading files with executable extensions, such as PHP scripts, which are typically blocked in secure configurations.
The operational impact of this vulnerability is severe, leading directly to Remote Code Execution on the affected server. By successfully uploading a maliciously crafted script via the vulnerable import endpoint, an attacker can place arbitrary code into the WordPress uploads directory. Since web servers often execute files with specific extensions like .php when accessed through HTTP requests, the uploaded file becomes active and executable. This allows the attacker to run commands with the same privileges as the web server process, potentially leading to full control over the underlying operating system, data exfiltration, defacement of the website, or use of the compromised host for further attacks against other systems on the network.
From a classification perspective, this vulnerability aligns with CWE-434, which describes Unrestricted Upload of File with Dangerous Type, and CWE-285, Improper Authorization. The exploitation technique maps to MITRE ATT&CK techniques related to Initial Access via Web Applications and Execution via Command Line Interface or Scripting Interpreter. Attackers can leverage this flaw during the initial compromise phase to establish a foothold within the target environment without needing high-level credentials initially, relying instead on lower-privilege accounts that may be more common in shared hosting or multi-user WordPress installations.
Mitigation strategies should focus on immediate patching and defensive configuration changes. The primary remediation is to update all affected plugins to versions 3.8.4 or later where the vendor has addressed these flaws by implementing proper capability checks and enforcing strict MIME type validation before file storage. In environments where updating is not immediately feasible, administrators can implement a Web Application Firewall rule to block requests targeting the specific vulnerable endpoints associated with the download_file_to_uploads function for unauthenticated or low-privilege users. Additionally, server-level hardening measures such as disabling PHP execution in the uploads directory via web server configuration (e.g., using .htaccess rules for Apache or location blocks for Nginx) can provide a critical layer of defense-in-depth to prevent code execution even if malicious files are successfully uploaded.