CVE-2026-12514
Deferred Deferred - Pending Action

Unauthenticated File Upload in Shared Files WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: WPScan

Description
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-12514
EUVD
EUVD-2026-67566

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
shared_files shared_files 1.7.67
shared_files_pro shared_files_pro 1.7.70
shared_files shared_files to 1.7.70 (exc)
shared_files_pro shared_files_pro to 1.7.67 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Shared Files WordPress plugin before version 1.7.67 and Shared Files Pro before 1.7.70 have an unauthenticated file upload vulnerability. The file-upload handler lacks proper capability checks and is only protected by a nonce available on public pages, allowing unauthenticated users to upload files to a publicly accessible directory. While uploads are restricted to WordPress-allowed MIME types, preventing PHP execution, the server's absolute path can still be exposed in the response.

Detection Guidance

Check if the Shared Files or Shared Files Pro WordPress plugins are installed and their versions. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly. Look for unauthenticated file upload attempts in server logs or WordPress activity logs.

Impact Analysis

An attacker could upload files to your server, potentially consuming disk space or exposing sensitive information like the server's absolute path. While executable files like PHP are blocked, other malicious files could still be uploaded and accessed if the directory is publicly accessible.

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially exposing sensitive data and violating compliance requirements for data protection and security. It may result in non-compliance with GDPR, HIPAA, or other regulations that mandate strict access controls and data integrity.

Mitigation Strategies

Update the Shared Files and Shared Files Pro plugins to versions 1.7.70 and 1.7.67 or higher respectively. If updates are unavailable, consider disabling the plugins temporarily until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12514. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart