CVE-2026-12514: Shared Files < 1.7.70 - Unauthenticated Limited File Upload
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it because the upload handler is available without login and its nonce is exposed on public pages. No WordPress capability is required.
Can this be used to upload and execute PHP code?
No. Uploads are restricted to MIME types allowed by WordPress, and executable PHP files cannot be uploaded through this issue.
What information can an attacker obtain besides uploading a file?
The upload response reveals the server's absolute filesystem path. Uploaded files are placed in a publicly accessible directory.