CVE-2026-19084: CWE-73 External Control of File Name or Path in shared-files-pro

The shared-files-pro WordPress plugin prior to version 1.7.70 does not properly validate the file path input used when creating a featured image. This lack of validation enables unauthenticated attackers to specify arbitrary file paths, resulting in the ability to read arbitrary files from the server. The contents of these files can then be republished at a public URL, potentially exposing sensitive server data. The vulnerability is classified under CWE-73 (External Control of File Name or Path).

An unauthenticated attacker can read arbitrary files on the affected server, leading to potential exposure of sensitive information. The vulnerability does not allow modification or deletion of files, nor does it impact availability. The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's communications for updates. Until a patch is available, restrict access to the plugin or disable it if possible to mitigate risk.