CVE-2026-85576

Name of the Vulnerable Software and Affected Versions All in One Files Upload WordPress plugin versions prior to 2.0.17

Description Insufficient capability checks and a lack of request authenticity verification occur when saving settings. This allows any authenticated user, including those with subscriber-level privileges, to modify the plugin settings.

Recommendations Update All in One Files Upload WordPress plugin to version 2.0.17 or later.