WordPress security by component

Shared Files

Plugin description

Shared Files publishes and manages downloadable files with searchable listings, categories, and controlled access options.

Shared Files (shared-files) is a WordPress plugin with 13 published CVE records in this archive. The latest tracked vulnerability was published Aug 28, 2026; the highest published CVSS base score is 7.5.

Plugin slug: shared-files

Latest vulnerability

CVE-2026-12514: Shared Files exposes a public file-upload handler without authorization

Shared Files before 1.7.67 and Shared Files Pro before 1.7.70 register a file-upload handler for unauthenticated visitors without a capability check. A nonce is exposed on public pages, so a visitor can upload WordPress-allowed file types to a public directory and obtain the server's absolute path from the response; PHP uploads remain blocked by the MIME allow-list.

PublishedAug 28, 2026

Known safe versionShared Files 1.7.67, Shared Files Pro 1.7.70

Published vulnerabilities for shared-files
		Safe version
Aug 28, 2026	CVE-2026-12514 Shared Files exposes a public file-upload handler without authorization Shared Files before 1.7.67 and Shared Files Pro before 1.7.70 register a file-upload handler for unauthenticated visitors without a capability check. A nonce is exposed on public pages, so a visitor can upload WordPress-allowed file types to a public directory and obtain the server's absolute path from the response; PHP uploads remain blocked by the MIME allow-list.	Shared Files 1.7.67, Shared Files Pro 1.7.70	CVE5.3 NVDPending
Aug 28, 2026	CVE-2026-12513 Shared Files path traversal turns entry deletion into arbitrary file deletion Shared Files before 1.7.67 and Shared Files Pro before 1.7.68 use a bypassable single-pass traversal filter on frontend file submissions. An unauthenticated attacker can store a path outside uploads; permanently deleting that entry later removes the referenced server file, including files such as wp-config.php, causing denial of service and possible site takeover.	Shared Files 1.7.67, Shared Files Pro 1.7.68	CVE6.8 NVDPending
Aug 24, 2026	CVE-2026-78269 Shared Files permits Contributor-level server-side request forgery Shared Files through 1.7.69 permits a Contributor to cause the WordPress server to issue an attacker-influenced outbound request. The CNA rates confidentiality and integrity impact as low with changed scope.	1.7.70	CVE6.4 NVDPending
Jun 15, 2026	CVE-2026-49112 Shared Files: Filesystem traversal Shared Files is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is n/a through 1.7.64.	1.7.65	CVE7.5 NVDPending
Mar 26, 2026	CVE-2025-15433 Shared Files: Filesystem traversal Shared Files is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is < 1.7.58.	1.7.58	CVE6.8 NVDPending
Feb 20, 2026	CVE-2024-34438 Shared Files: A security weakness Shared Files is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Jun 03, 2025	CVE-2025-4392 Shared Files – Frontend File Upload Form & Secure File Sharing: Cross-site scripting Shared Files – Frontend File Upload Form & Secure File Sharing is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVDPending
Jan 31, 2025	CVE-2024-13504 Shared Files – Frontend File Upload Form & Secure File Sharing: Cross-site scripting Shared Files – Frontend File Upload Form & Secure File Sharing is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.2 NVDPending
Aug 26, 2024	CVE-2024-43230 Shared Files: A security weakness Shared Files is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD7.5
Apr 23, 2024	CVE-2024-32679 Shared Files: A security weakness Shared Files is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Oct 16, 2023	CVE-2023-4819 Shared Files: A security weakness Shared Files is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.1 NVD6.1
Nov 17, 2021	CVE-2021-24856 Shared Files: Cross-site scripting Shared Files is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8
Oct 18, 2021	CVE-2021-24736 Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Cross-site scripting Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers