CVE-2026-85576: CWE-862 Missing Authorization in All in One Files Upload
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
AI Analysis
Technical Summary
CVE-2026-85576 identifies a missing authorization vulnerability (CWE-862) in the All in One Files Upload WordPress plugin before version 2.0.17. The plugin does not verify user capabilities or the authenticity of requests when saving its settings, enabling any authenticated user to change configuration settings regardless of their privilege level.
Potential Impact
Any authenticated user, even those with minimal privileges, can alter the plugin's settings. This could lead to unauthorized configuration changes that may affect site functionality or security posture. However, there is no indication of remote unauthenticated exploitation or direct code execution from this vulnerability.
Mitigation Recommendations
Upgrade the All in One Files Upload plugin to version 2.0.17 or later where this authorization issue is fixed. No other mitigation steps are indicated as the vulnerability is resolved by the official update.
CVE-2026-85576: CWE-862 Missing Authorization in All in One Files Upload
Description
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
Affected software
All in One Files Upload
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85576 identifies a missing authorization vulnerability (CWE-862) in the All in One Files Upload WordPress plugin before version 2.0.17. The plugin does not verify user capabilities or the authenticity of requests when saving its settings, enabling any authenticated user to change configuration settings regardless of their privilege level.
Potential Impact
Any authenticated user, even those with minimal privileges, can alter the plugin's settings. This could lead to unauthorized configuration changes that may affect site functionality or security posture. However, there is no indication of remote unauthenticated exploitation or direct code execution from this vulnerability.
Mitigation Recommendations
Upgrade the All in One Files Upload plugin to version 2.0.17 or later where this authorization issue is fixed. No other mitigation steps are indicated as the vulnerability is resolved by the official update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-04T10:56:03.374Z
- State
- PUBLISHED
Threat ID: 6abcab01236a9c741f0494b2
Added to database: 09/30/2026, 06:24:01 UTC
Last enriched: 09/30/2026, 06:39:26 UTC
Last updated: 09/30/2026, 07:39:38 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.