CVE-2026-12513: Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Shared Files pluginto a version that resolves this vulnerability.Fixed in 1.7.67 - Upgrade
Upgrade
WordPress shared-files-pro pluginto a version that resolves this vulnerability.Fixed in 1.7.68
Event History
Frequently Asked Questions
Which installations are affected?
Shared Files versions before 1.7.67 and shared-files-pro versions before 1.7.68 are affected.
Does an attacker need an account or administrative access?
No. The vulnerable file submission can be made by an unauthenticated user.
What must occur for the targeted server file to be deleted?
The attacker must first cause a file entry to store a path outside the uploads directory. The arbitrary file is deleted when that corresponding entry is later permanently deleted.