CVE-2026-93031 File upload in Share-one-Drive | OneDrive & SharePoint plugin for WordPress
Authenticated subscribers can upload executable files via media import, leading to remote code execution on WordPress sites using affected cloud storage plugins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93031?
CVE-2026-93031 is a high-severity vulnerability in WP Cloud Plugins/_deleeuw_ Share-one-Drive | OneDrive & SharePoint plugin for WordPress, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
Weakness: CWE-434
Which versions are affected by CVE-2026-93031?
How do I fix CVE-2026-93031?
No fix has been published for CVE-2026-93031 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93031 being exploited?
There is no known exploitation of CVE-2026-93031 in the wild and no public exploit code.
Sources
Also known as GHSA-v278-3mjv-f38g.