Executive brief
The Shared Files WordPress plugin allows unauthenticated visitors to upload files to the server through a missing capability check, exposing the server's file path. While uploads are restricted to safe file types (no PHP execution), an attacker can upload arbitrary non-executable files and discover the server's internal directory structure, potentially aiding reconnaissance for follow-up attacks.
Technical details
The vulnerability is a broken access control issue (CWE-862) in the file-upload handler registered for unauthenticated users. The handler relies only on a nonce value that is publicly embedded in front-end pages, rather than verifying user capabilities. An unauthenticated attacker can craft a POST request to wp-admin/admin-ajax.php with the action "shared_files_file_upload" and a valid nonce to upload files. While WordPress's MIME type allowlist prevents PHP file uploads, the response returns the absolute server path, enabling path disclosure. Fixed in Shared Files version 1.7.67 and Shared Files PRO version 1.7.70.
Affected products
- Shared Files Shared Files before 1.7.67
- Shared Files Shared Files PRO before 1.7.70
Timeline
- 2026-08-26: disclosed: Publicly published on WPScan
- 2026-08-28: advisory: CVE-2026-12514 published on NVD