Vulnerability · Published Aug 28, 2026 · Assigned by WPScan

CVE-2026-12513Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal

Medium 6.8

In plain English

A medium-severity security flaw in Shared Files from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 67.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Shared Files	0 – before 1.7.67
Unknown	shared-files-pro	0 – before 1.7.68

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

References

https://wpscan.com/vulnerability/25c9fa21-c48b-4333-8abc-87230dc4c869/ exploit, vdb-entry, technical-description