CVE-2026-12513: CWE-73 External Control of File Name or Path in Shared Files

The Shared Files WordPress plugin versions prior to 1.7.67 and shared-files-pro versions prior to 1.7.68 do not properly sanitize file paths submitted from the frontend. Their single-pass traversal filter can be bypassed, enabling unauthenticated attackers to store paths pointing outside the uploads directory. When the plugin later deletes the associated file entry, it may delete arbitrary files on the server, including critical configuration files like wp-config.php. This vulnerability is tracked as CVE-2026-12513 and is categorized under CWE-73 (External Control of File Name or Path).

Exploitation allows unauthenticated attackers to delete arbitrary files on the server, leading to denial of service and potentially enabling site takeover by removing critical files such as wp-config.php. The CVSS score is 6.8 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's file submission functionality if possible and monitor for suspicious file deletion activity related to the plugin.