CyberRota Analysis
AI-GeneratedThe Shared Files and shared-files-pro WordPress plugins prior to versions 1.7.67 and 1.7.70, respectively, lack proper capability checks in their file-upload handlers, allowing unauthenticated users to upload files to a publicly accessible directory. This vulnerability could lead to information disclosure, as attackers can read the server's absolute path from the response, although they are restricted to uploading non-executable file types. WordPress site administrators using these plugins should prioritize updating to mitigate potential exposure.
Original NVD Description
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.