WordPress Plugin Vulnerabilities

Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read

Description

The plugin does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

Proof of Concept

Affects Plugins

Plugin icon
shared-files-pro
Fixed in 1.7.70

References

CVE
CVE-2026-19084

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
48b86169-5ccf-4111-be15-9dd45d478465

Timeline

Publicly Published
2026-08-26 (about 2 days ago)
Added
2026-08-26 (about 1 day ago)
Last Updated
2026-08-27 (about 9 hours ago)

Other

Published
Title
Published
2025-03-25
Title
Product Import Export for WooCommerce < 2.5.1 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
Published
2026-06-16
Title
WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
Published
2026-07-30
Title
Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle
Published
2025-03-06
Title
CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read
Published
2025-05-23
Title
eMagicOne Store Manager for WooCommerce < 1.3.0 - Unauthenticated Arbitrary File Deletion