The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 28 Aug 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL. | |
| Title | Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-08-28T06:00:16.188Z
Reserved: 2026-08-06T12:20:17.235Z
Link: CVE-2026-19084
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-28T08:16:40.513
Modified: 2026-08-28T08:16:40.513
Link: CVE-2026-19084
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.