The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request,… (CVE-2026-85576)
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
AI Analysis
Technical Summary
CVE-2026-85576 identifies a missing authorization vulnerability (CWE-862) in the All in One Files Upload WordPress plugin before version 2.0.17. The plugin does not verify user capabilities or the authenticity of requests when saving its settings, enabling any authenticated user to change configuration settings regardless of their privilege level.
Potential Impact
Any authenticated user, even those with minimal privileges, can alter the plugin's settings. This could lead to unauthorized configuration changes that may affect site functionality or security posture. However, there is no indication of remote unauthenticated exploitation or direct code execution from this vulnerability.
Mitigation Recommendations
Upgrade the All in One Files Upload plugin to version 2.0.17 or later where this authorization issue is fixed. No other mitigation steps are indicated as the vulnerability is resolved by the official update.
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request,… (CVE-2026-85576)
Description
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85576 identifies a missing authorization vulnerability (CWE-862) in the All in One Files Upload WordPress plugin before version 2.0.17. The plugin does not verify user capabilities or the authenticity of requests when saving its settings, enabling any authenticated user to change configuration settings regardless of their privilege level.
Potential Impact
Any authenticated user, even those with minimal privileges, can alter the plugin's settings. This could lead to unauthorized configuration changes that may affect site functionality or security posture. However, there is no indication of remote unauthenticated exploitation or direct code execution from this vulnerability.
Mitigation Recommendations
Upgrade the All in One Files Upload plugin to version 2.0.17 or later where this authorization issue is fixed. No other mitigation steps are indicated as the vulnerability is resolved by the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xrrq-7x9p-r92r
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-85576"]
- State
- PUBLISHED
Threat ID: 6abcddd50df196e1a9da6ee3
Added to database: 09/30/2026, 10:00:53 UTC
Last enriched: 09/30/2026, 06:39:26 UTC
Last updated: 09/30/2026, 13:49:29 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.