CVE-2026-12513

Name of the Vulnerable Software and Affected Versions Shared Files WordPress plugin versions prior to 1.7.67 shared-files-pro WordPress plugin versions prior to 1.7.68

Description Improper sanitization of file paths during frontend file submissions allows unauthenticated users to bypass the single-pass traversal filter. This enables the storage of paths pointing outside the uploads directory. When a corresponding file entry is permanently deleted, an arbitrary file on the server, such as wp-config.php, can be deleted, resulting in a denial of service and potential site takeover.

Recommendations Update Shared Files WordPress plugin to version 1.7.67 or later. Update shared-files-pro WordPress plugin to version 1.7.68 or later.