CVE-2026-15958
Received Received - Intake

Unauthenticated File Management Vulnerabilities in Easy Integration for Dropbox WordPress Plugin

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: WPScan

Description
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-15958
EUVD
EUVD-2026-52590

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
easy_integration_for_dropbox wordpress_plugin to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Easy Integration for Dropbox WordPress plugin before version 2.2.0. It allows unauthenticated attackers to perform unauthorized file operations like listing, downloading, and uploading files in the connected Dropbox account. It also exposes connected account and administrator email addresses due to missing authorization checks on certain AJAX actions.

Detection Guidance

Check if the Easy Integration for Dropbox WordPress plugin version is below 2.2.0. Inspect network traffic for unauthorized AJAX actions related to file management in the plugin. Look for unusual file uploads, downloads, or listing activities in connected Dropbox accounts.

Impact Analysis

If you use this plugin, an attacker could access sensitive files in your Dropbox account without authentication. They could steal or modify files, potentially leading to data breaches or loss. Additionally, your email addresses could be exposed, increasing the risk of phishing or targeted attacks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal or sensitive data. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. A breach could result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the Easy Integration for Dropbox WordPress plugin to version 2.2.0 or later immediately. Disable the plugin if an update is not available. Review Dropbox account activity for unauthorized access and revoke any suspicious third-party app permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart