CVE-2026-19084: Shared Files Pro Path Traversal Vulnerability

CVE-2026-19084 Overview

CVE-2026-19084 affects the Shared Files Pro WordPress plugin in versions prior to 1.7.70. The plugin fails to validate file paths supplied during featured image creation. Unauthenticated attackers can supply arbitrary server paths and force the plugin to read local files. The plugin then republishes the contents at a publicly accessible URL. This exposes sensitive files including wp-config.php, private keys, and system configuration data. The weakness is classified as [CWE-73] External Control of File Name or Path.

Critical Impact
Unauthenticated remote attackers can exfiltrate arbitrary files from the WordPress host, including credentials stored in wp-config.php, over a public URL without any user interaction.

Affected Products

Shared Files Pro WordPress plugin versions before 1.7.70
WordPress installations with Shared Files Pro enabled
Any hosting environment exposing the plugin's featured image endpoint

Discovery Timeline

2026-08-28 - CVE-2026-19084 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-19084

Vulnerability Analysis

The vulnerability resides in the featured image creation workflow of Shared Files Pro. The plugin accepts a file path parameter from the request and uses it directly to load image content. No canonicalization or allow-list check runs against the supplied path. The plugin then stores the retrieved bytes and exposes them through a publicly reachable URL.

An unauthenticated attacker can therefore reference any file the web server user can read. This includes WordPress secrets, database credentials, SSH keys mounted in the webroot, and Linux configuration files such as /etc/passwd. Because the content is republished at a public URL, the attacker retrieves it with a simple HTTP GET after triggering the upload.

Root Cause

The root cause is missing input validation on the featured image file path parameter. The plugin treats attacker-controlled input as a trusted local reference. This maps to [CWE-73], External Control of File Name or Path. A safe implementation would restrict inputs to a whitelist of upload directories and reject absolute paths or traversal sequences such as ../.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends a crafted request to the featured image creation endpoint referencing a sensitive local path. The plugin reads the file server-side, creates a featured image asset containing the raw bytes, and returns or exposes the resulting public URL. The attacker then downloads the file contents anonymously. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-19084

Indicators of Compromise

Unauthenticated POST or GET requests to Shared Files Pro featured image endpoints containing absolute paths or ../ traversal sequences
Newly created featured image attachments referencing filenames outside the standard wp-content/uploads directory
Public access log entries retrieving media URLs whose content matches wp-config.php or other configuration files
Sudden spikes in featured image creation from anonymous sources

Detection Strategies

Inspect WordPress media library entries for images whose stored payload is not a valid image binary
Correlate web server access logs with plugin action parameters referencing filesystem paths
Alert on responses to media URLs that return non-image MIME content or text such as DB_PASSWORD
Monitor for HTTP requests targeting the shared-files-pro plugin path prefix from unauthenticated clients

Monitoring Recommendations

Enable verbose logging on the WordPress plugin action endpoints and forward logs to a centralized analytics platform
Baseline normal featured image creation volume and alert on deviations
Track outbound serving of files whose byte signatures do not match declared image types

How to Mitigate CVE-2026-19084

Immediate Actions Required

Update Shared Files Pro to version 1.7.70 or later on all WordPress instances
Rotate all secrets stored in wp-config.php, including AUTH_KEY, database credentials, and API tokens, if the plugin was internet-exposed
Audit the WordPress media library for suspicious attachments created before patching and remove any that contain non-image data
Review web server access logs for prior exploitation attempts against the featured image endpoint

Patch Information

The vendor addressed the vulnerability in Shared Files Pro version 1.7.70. The fix validates the file path supplied during featured image creation and rejects paths outside the plugin's permitted upload directories. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Shared Files Pro plugin until the update to 1.7.70 can be applied
Restrict access to the plugin endpoints using a web application firewall rule that blocks requests containing ../ or absolute paths in file parameters
Enforce filesystem permissions so the web server user cannot read sensitive files such as wp-config.php beyond required access

bash

# Example WAF rule (ModSecurity) to block path traversal in plugin requests
SecRule REQUEST_URI "@contains shared-files-pro" \
    "chain,deny,status:403,id:1026190840,msg:'Block CVE-2026-19084 path traversal'"
    SecRule ARGS "@rx (\.\./|^/)" "t:none,t:urlDecodeUni"