CVE-2026-93031: WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for unauthenticated users via wpajaxnopriv, a missing capability check in canimport(), and the imported file's extension and contents not being validated against getallowedmimetypes() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Installations using Use-your-Drive, Out-of-the-Box, Share-one-Drive, or Lets-Box versions 2.0 through 3.8.3 are affected.
What access does an attacker need?
The issue can be exploited by an authenticated WordPress user with Subscriber-level access or higher. No user interaction is required.
What is the likely impact of successful exploitation?
An attacker can upload files to the WordPress uploads directory without extension or content validation. Because uploaded files may be executable, this can lead to remote code execution and compromise of confidentiality, integrity, and availability.
Is the import endpoint exposed to unauthenticated requests?
The import action is registered through wp_ajax_nopriv_, which exposes it to unauthenticated requests. However, the stated exploitation condition identifies authenticated users with Subscriber-level access or above.
What version addresses the issue?
The affected range ends at version 3.8.3, and the referenced changelog includes version 3.9.0. The provided data does not explicitly state that 3.9.0 is the fixed version.