CVE-2026-19084
Deferred Deferred - Pending Action

Unauthenticated File Read via Featured Image in shared-files-pro WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: WPScan

Description
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-19084
EUVD
EUVD-2026-67569

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shared_files shared_files to 1.7.70 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The shared-files-pro WordPress plugin before version 1.7.70 has a vulnerability where it does not validate file paths when creating a featured image. This allows unauthenticated attackers to read any file on the server and republish its contents at a public URL.

Detection Guidance

Check if the shared-files-pro WordPress plugin version is below 1.7.70. Look for unauthorized file reads or featured image creation attempts in server logs. No specific commands are provided in the context.

Impact Analysis

Attackers could access sensitive files on your server, such as configuration files, user data, or other confidential information. They could then make this data publicly available, leading to data breaches or privacy violations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could result in legal penalties or fines.

Mitigation Strategies

Update the shared-files-pro plugin to version 1.7.70 or higher immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart