Shared Files exposes a public file-upload handler without authorization
Shared Files before 1.7.67 and Shared Files Pro before 1.7.70 register a file-upload handler for unauthenticated visitors without a capability check. A nonce is exposed on public pages, so a visitor can upload WordPress-allowed file types to a public directory and obtain the server's absolute path from the response; PHP uploads remain blocked by the MIME allow-list.
- Component
- Multiple WordPress plugins
- Plugin slug
shared-files- Affected
- See vendor advisory
- Safe version
Shared Files 1.7.67, Shared Files Pro 1.7.70- Published
- Aug 28, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Aug 28, 2026 and is one of 13 known issues for this plugin.
Update, patch or deactivate.
Update Shared Files to 1.7.67 or later and Shared Files Pro to 1.7.70 or later. Review public uploads and remove unauthorized files.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N