CVE-2026-12514

Name of the Vulnerable Software and Affected Versions Shared Files versions prior to 1.7.67 shared-files-pro versions prior to 1.7.70

Description The file-upload handler is registered for unauthenticated users and lacks a capability check, relying solely on a nonce output on public pages. This allows an unauthenticated visitor to upload files to a publicly accessible directory and retrieve the server's absolute path from the response. File uploads are restricted to WordPress's allowed MIME types, preventing the upload of executable PHP files.

Recommendations Update Shared Files to version 1.7.67 or later. Update shared-files-pro to version 1.7.70 or later.