CVE-2026-12514: CWE-862 Missing Authorization in Shared Files

CVE-2026-12514 describes a missing authorization (CWE-862) vulnerability in the Shared Files WordPress plugin and its pro version. The file-upload handler does not perform capability checks and is registered for unauthenticated users, relying solely on a nonce that is output on public pages. This allows unauthenticated attackers to upload files to a public directory and obtain the server's absolute path from the response. However, the upload is limited to allowed MIME types, so executable PHP files cannot be uploaded.

An unauthenticated attacker can upload files to a publicly accessible directory and read the server's absolute path. This could facilitate further attacks or information gathering but does not allow uploading executable PHP files, limiting the potential for direct remote code execution. The confidentiality impact is none, integrity impact is low, and availability impact is none, consistent with the CVSS score of 5.3 (medium).

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the file-upload handler or disabling the plugin if possible to prevent unauthorized uploads.