CVE-2026-12514 Shared Files < 1.7.70 - Unauthenticated Limited File Upload
Unauthenticated attackers can upload files to a public directory and read server paths due to missing capability checks in the Shared Files WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12514?
CVE-2026-12514 is a medium-severity missing authorization vulnerability in Unknown Shared Files, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Weakness: CWE-862
Which versions are affected by CVE-2026-12514?
How do I fix CVE-2026-12514?
No fix has been published for CVE-2026-12514 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-12514 being exploited?
There is no known exploitation of CVE-2026-12514 in the wild and no public exploit code.
Sources
Also known as GHSA-4qpc-6xpr-g8g2.