Executive brief
Easy Integration for Dropbox is a WordPress plugin that connects a site to a Dropbox account for file management. The plugin failed to verify user permissions on several file-handling operations, allowing unauthenticated visitors to view, download, and upload files to the connected Dropbox account without restriction, as well as access the email addresses of the Dropbox owner and WordPress administrator.
Technical details
The plugin registers AJAX actions (edbi_get_files, edbi_download_file, edbi_upload) for unauthenticated users but fails to enforce authorization checks on them. While a nonce is required, the plugin accepts requests that omit the shortcode_id parameter, bypassing folder-level access restrictions and granting access to the entire connected Dropbox account. The root cause is missing capability checks and flawed path-validation logic. An unauthenticated attacker can craft AJAX POST requests to list arbitrary directories, download any file, or upload files to any path within the connected Dropbox account. The vulnerability requires the plugin to be active and a Dropbox account to be connected, but no WordPress user account or authentication is needed. Patch version 2.2.0 is available.
Affected products
- WordPress Easy Integration for Dropbox before 2.2.0
Timeline
- 2026-07-27: disclosed
- 2026-08-04: advisory
- 2026-07-27: patched: Version 2.2.0 released