Executive brief
The Shared Files plugin for WordPress, which allows users to manage and share documents on their websites, contains a security flaw that allows unauthorized access to files. An attacker can exploit this to view sensitive system files or private documents stored on the web server without needing a password. This could lead to the exposure of confidential business data or configuration files that facilitate further attacks.
Technical details
A path traversal vulnerability (CWE-35) exists in the Tammersoft Shared Files plugin for WordPress due to insufficient sanitization of user-supplied input in file-handling components. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests containing directory traversal sequences (e.g., ../../) to access files outside of the intended directory. This allows for the unauthorized retrieval of sensitive information, such as the wp-config.php file or other system-level data. The vulnerability is resolved in version 1.7.65.
Affected products
- Tammersoft Shared Files <= 1.7.64
Timeline
- 2026-04-22: other: Vulnerability reported by researcher kai63001
- 2026-06-05: advisory: Patchstack advisory published
- 2026-06-15: disclosed: CVE published to NVD