CVE-2026-12514 Overview
CVE-2026-12514 affects the Shared Files and shared-files-pro WordPress plugins. The vulnerability stems from a missing capability check in the file-upload handler [CWE-862]. The handler is registered for unauthenticated users and protected only by a nonce that is output on public pages. An unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are restricted to WordPress's allowed MIME types, which prevents executable PHP from being uploaded.
Critical Impact
Unauthenticated attackers can upload arbitrary non-executable files to public directories and disclose the server's absolute filesystem path.
Affected Products
- Shared Files WordPress plugin before 1.7.67
- shared-files-pro WordPress plugin before 1.7.70
- WordPress installations exposing plugin nonces on public pages
Discovery Timeline
- 2026-08-28 - CVE-2026-12514 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-12514
Vulnerability Analysis
The Shared Files plugin registers its file-upload AJAX handler for both authenticated and unauthenticated WordPress users. The handler validates a nonce but never invokes a WordPress capability check such as current_user_can(). Because the required nonce is rendered on public pages, an anonymous visitor can retrieve it and submit an upload request that the plugin accepts.
Successful requests place attacker-controlled files in a publicly accessible uploads directory. The server response includes the absolute filesystem path of the uploaded file, disclosing internal directory structure that supports further reconnaissance. The impact is bounded by WordPress's wp_check_filetype_and_ext() allow-list, so PHP and other executable content cannot be written.
Root Cause
The root cause is a missing authorization check [CWE-862] in the upload handler. The plugin treats nonce possession as sufficient authorization. Because nonces are emitted on public pages, this reduces access control to a trivially discoverable token rather than an identity or capability check.
Attack Vector
An unauthenticated attacker fetches a public page from the target site to harvest the plugin's nonce. The attacker then submits a multipart POST request to the plugin's admin-ajax.php upload action with a file that matches a WordPress-permitted MIME type. The server writes the file to the shared uploads directory and returns a JSON response containing the absolute server path.
Exploitation requires no user interaction and no privileges. See the WPScan Vulnerability Advisory for full technical details.
Detection Methods for CVE-2026-12514
Indicators of Compromise
- Unexpected files in the Shared Files plugin uploads directory owned by the web server user
- Anonymous POST requests to admin-ajax.php referencing the plugin's upload action
- HTTP 200 responses to unauthenticated upload actions containing absolute filesystem paths
- Unusual image, PDF, or archive files uploaded outside of normal administrative workflows
Detection Strategies
- Monitor web access logs for POST requests to admin-ajax.php with the plugin's upload action name from unauthenticated sessions
- Alert on file creation events inside the Shared Files uploads directory when the source IP is external
- Correlate nonce-fetching GET requests to public pages with subsequent upload POSTs from the same client
Monitoring Recommendations
- Enable WordPress and web server access logging with request body metadata retention
- Baseline the volume and file types written to the plugin's uploads directory and alert on deviations
- Track responses that leak absolute filesystem paths as a data-exposure signal
How to Mitigate CVE-2026-12514
Immediate Actions Required
- Update Shared Files to version 1.7.67 or later
- Update shared-files-pro to version 1.7.70 or later
- Audit the plugin's uploads directory and remove any files that cannot be attributed to a legitimate user
- Review web server logs for unauthenticated POST requests to the plugin's upload endpoint
Patch Information
The plugin vendor addressed the missing capability check in Shared Files 1.7.67 and shared-files-pro 1.7.70. Refer to the WPScan Vulnerability Advisory for advisory details and version guidance.
Workarounds
- Deactivate the Shared Files and shared-files-pro plugins until patches are applied
- Restrict access to admin-ajax.php for the plugin's upload action using a web application firewall rule
- Deny direct HTTP access to the plugin's uploads directory at the web server level
- Remove upload-related nonces from public page output where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
