CVE-2026-15958 is a missing authorization vulnerability (CWE-862) in the Easy Integration for Dropbox WordPress plugin prior to version 2.2.0. The plugin fails to enforce authorization on multiple file-management AJAX endpoints that are also registered for unauthenticated users. This flaw permits unauthenticated attackers to perform unauthorized file operations—listing, downloading, and uploading files—within the connected Dropbox account. Additionally, attackers can read the connected Dropbox account and administrator email addresses. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity with network attack vector, no privileges required, no user interaction, and high confidentiality impact.

An unauthenticated attacker can fully interact with the connected Dropbox account's files, including listing, downloading, and uploading arbitrary files. This compromises the confidentiality of the Dropbox account data and exposes sensitive email addresses. The integrity impact is limited to file upload (low), and availability is not affected. The vulnerability poses a critical risk to the confidentiality and integrity of the Dropbox account linked to the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints or disable the plugin if possible. Monitor for updates from the plugin vendor and apply any released patches promptly.