CVE-2026-93031: WP Cloud Plugins File Upload RCE Flaw

CVE-2026-93031 Overview

CVE-2026-93031 is an arbitrary file upload vulnerability affecting four WP Cloud Plugins for WordPress: Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box. The flaw exists in the download_file_to_uploads function across all versions from 2.0 through 3.8.3. Authenticated attackers with subscriber-level access can upload executable files to the WordPress uploads directory, leading to remote code execution. The vulnerability stems from the wp_ajax_nopriv_ action registration, a missing capability check in can_import(), and the absence of MIME type validation before file writes. This weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact

Subscriber-level authenticated users can achieve remote code execution on WordPress sites running vulnerable versions of the affected WP Cloud Plugins.

Affected Products

• WP Cloud Plugins Use-your-Drive (versions 2.0 through 3.8.3)
• WP Cloud Plugins Out-of-the-Box (versions 2.0 through 3.8.3)
• WP Cloud Plugins Share-one-Drive and Lets-Box (versions 2.0 through 3.8.3)

Discovery Timeline

• 2026-09-18 - CVE-2026-93031 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-93031

Vulnerability Analysis

The vulnerability resides in the download_file_to_uploads function used by four WP Cloud Plugins that share a common cloud storage integration codebase. The import action is registered via the WordPress wp_ajax_nopriv_ hook, which exposes the endpoint to unauthenticated users by design. The can_import() function fails to enforce a capability check, allowing any authenticated user with subscriber privileges to reach the vulnerable code path.

Once reached, the function writes the imported file to the WordPress uploads directory without validating the file extension or contents against get_allowed_mime_types(). Attackers can supply PHP files or other executable content, which the web server may then interpret when accessed directly.

Root Cause

The root cause combines three defects: overly permissive AJAX action registration, missing authorization enforcement, and absent MIME type validation. The get_allowed_mime_types() function is bypassed entirely because the download path treats remote file imports as trusted operations. WordPress installations that permit user registration expand the attack surface, since any registrant qualifies as a subscriber.

Attack Vector

Exploitation requires authentication at the subscriber level, which is trivially obtained on sites with open user registration. An attacker submits a crafted request to the plugin's import AJAX endpoint, specifying a remote URL that returns a PHP payload. The plugin downloads the file and writes it to the uploads directory under a predictable path. The attacker then requests the uploaded file directly, causing the web server to execute the embedded PHP code with the privileges of the WordPress process.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-93031

Indicators of Compromise

• Unexpected PHP, PHTML, or other executable files present in the wp-content/uploads/ directory tree, particularly under plugin-specific subdirectories.
• HTTP POST requests to admin-ajax.php with import-related action parameters originating from low-privilege user sessions.
• Outbound HTTP requests from the web server to attacker-controlled URLs immediately preceding new file creation in the uploads directory.
• Web server access logs showing direct GET requests to newly created files in the uploads directory shortly after import activity.

Detection Strategies

• Monitor WordPress admin-ajax.php traffic for import actions tied to the affected plugins and correlate with the requesting user's role.
• Alert on new files with executable extensions written to the uploads directory, which should normally contain only media assets.
• Baseline outbound network connections from the web server and flag anomalous fetches to external hosts during plugin import operations.

Monitoring Recommendations

• Enable WordPress audit logging for file upload events and user role changes to detect exploitation attempts and post-compromise activity.
• Integrate web server and application logs into a centralized analytics platform to correlate authentication events with file system changes.
• Deploy file integrity monitoring across the wp-content/uploads/ and plugin directories to detect unauthorized modifications.

How to Mitigate CVE-2026-93031

Immediate Actions Required

• Update Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box to version 3.9.0 or later immediately.
• Audit all files in the WordPress uploads directory for unexpected executable content and remove any suspicious files.
• Review WordPress user accounts and remove untrusted subscriber accounts created during the vulnerability window.
• Rotate WordPress administrator credentials and API keys if compromise is suspected.

Patch Information

The vendor addressed CVE-2026-93031 in version 3.9.0 of the affected plugins. Full release notes are available in the WP Cloud Plugins Changelog v3.9.0 and mirrored on the WP Cloud Plugins Documentation site. Upgrade all four affected plugins, as they share the vulnerable codebase.

Workarounds

• Disable the affected plugins until the update to version 3.9.0 or later can be applied.
• Disable open user registration on the WordPress site to prevent attackers from obtaining subscriber-level accounts.
• Configure the web server to deny PHP execution within the wp-content/uploads/ directory using directives that block script interpretation.
• Restrict access to admin-ajax.php import endpoints via a web application firewall rule that inspects requesting user roles.

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}