CVE-2026-12513 Overview
CVE-2026-12513 affects the Shared Files and Shared Files Pro WordPress plugins. The vulnerability allows unauthenticated attackers to store a file path that escapes the uploads directory through a bypassable path traversal filter. When an administrator later permanently deletes the corresponding file entry, the plugin removes an arbitrary file from the server. Attackers can target sensitive files such as wp-config.php, causing denial of service and enabling site takeover conditions. The flaw is classified as [CWE-73] External Control of File Name or Path.
Critical Impact
Unauthenticated attackers can trigger deletion of arbitrary server files, including wp-config.php, leading to site takeover through the WordPress setup flow.
Affected Products
- Shared Files WordPress plugin before version 1.7.67
- Shared Files Pro WordPress plugin before version 1.7.68
- WordPress sites accepting frontend file submissions via these plugins
Discovery Timeline
- 2026-08-28 - CVE-2026-12513 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-12513
Vulnerability Analysis
The Shared Files plugin accepts file submissions from the frontend and stores metadata that includes a file path. The plugin applies a sanitization routine intended to strip directory traversal sequences from the submitted path. The filter performs only a single pass over the input, so nested traversal sequences survive sanitization.
An unauthenticated user can submit a crafted path that resolves outside the plugin's uploads directory after sanitization. The plugin persists this path in the database as part of the file entry record. When an administrator later chooses to permanently delete that entry, the plugin passes the stored path to a file deletion routine without revalidating its location.
Exploitation requires user interaction from a privileged operator who deletes the malicious entry. Successful exploitation removes arbitrary files, including WordPress core configuration files. Deleting wp-config.php forces WordPress into its initial setup state, which an attacker can complete to point the site at an attacker-controlled database and take over the installation.
Root Cause
The root cause is a single-pass traversal filter that fails to handle overlapping or recursive ../ sequences. The plugin also trusts the sanitized path at deletion time rather than confining deletions to the uploads directory. This combination of insufficient input validation and missing path confinement enables the arbitrary file deletion.
Attack Vector
The vulnerability is exploitable over the network through the plugin's frontend submission endpoint. No authentication is required to plant the malicious path. Exploitation completes only when an administrator permanently deletes the file entry, which introduces the user interaction requirement. The WPScan advisory documents the bypass and confirms the impact on file integrity and availability. See the WPScan Vulnerability Report for the disclosure details.
Detection Methods for CVE-2026-12513
Indicators of Compromise
- File entries in the Shared Files plugin database tables containing paths with traversal sequences such as ..//..// or encoded variants.
- Frontend submission requests from unauthenticated sources referencing paths outside the plugin's uploads directory.
- Missing or recently deleted wp-config.php, .htaccess, or other core files followed by unexpected WordPress setup screens.
Detection Strategies
- Audit the plugin's stored file entries for path values that resolve outside the configured uploads directory.
- Enable WordPress debug logging and web server access logging for the plugin's submission endpoints to capture traversal payloads.
- Correlate administrator file-deletion actions with subsequent web server errors or file integrity monitor alerts.
Monitoring Recommendations
- Deploy file integrity monitoring on wp-config.php, .htaccess, and PHP files in the WordPress root and wp-content directories.
- Alert on HTTP 200 responses from the plugin's submission handler containing traversal patterns in POST bodies.
- Monitor for the appearance of the WordPress installation wizard (/wp-admin/install.php) on production hosts.
How to Mitigate CVE-2026-12513
Immediate Actions Required
- Update Shared Files to version 1.7.67 or later, and Shared Files Pro to version 1.7.68 or later.
- Review existing plugin file entries for paths that reference locations outside the uploads directory and delete suspicious records only after confirming the resolved target.
- Back up wp-config.php and other critical configuration files before performing bulk deletions in the plugin interface.
Patch Information
The vendor addressed the issue in Shared Files 1.7.67 and Shared Files Pro 1.7.68. The fixed versions apply a corrected traversal filter and constrain deletions to the uploads directory. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Shared Files plugin until the patched version is deployed.
- Restrict frontend file submissions using a web application firewall rule that blocks ../ and URL-encoded traversal sequences in submission parameters.
- Set filesystem permissions so the web server user cannot delete wp-config.php or other files outside the uploads directory.
# Example WAF rule concept to block traversal in submission parameters
# Reject requests to the plugin submission endpoint containing traversal sequences
SecRule REQUEST_URI "@contains /shared-files" "chain,deny,status:403,id:1026125131"
SecRule ARGS "@rx (\.\./|\.\.%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
