Executive brief
Four WordPress plugins from WP Cloud Plugins (Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box) allow unauthenticated users to upload files to the website without proper validation. An attacker with a basic subscriber account can upload and execute malicious code on the server, potentially taking complete control of the WordPress site and exposing sensitive data.
Technical details
The download_file_to_uploads function in the import action lacks capability checks and file validation, allowing unauthenticated users (via wp_ajax_nopriv_) to bypass security controls. The vulnerability affects file extension and MIME type validation, permitting executable file uploads. Attackers with subscriber-level or higher privileges can exploit this to achieve remote code execution by uploading malicious scripts.
Affected products
- WP Cloud Plugins Use-your-Drive 2.0 to 3.8.3
- WP Cloud Plugins Out-of-the-Box 2.0 to 3.8.3
- WP Cloud Plugins Share-one-Drive 2.0 to 3.8.3
- WP Cloud Plugins Lets-Box 2.0 to 3.8.3
Timeline
- 2026-09-18: disclosed