Plugins · shared-files · data as of 2026-11-04
Is Shared Files safe? Known vulnerabilities and latest version
- Latest version
- 1.7.72
- Last updated
- 2026-10-21
- Active installs
- 4,000+
- Known issues on record
- 12
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.2+
File management plugin featuring file upload, download manager, statistics and download log. — by Anssi Laitila
What to do
- Update to the latest version (1.7.72). Anything older than 1.7.70 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get shared-files --field=version shows what you run; wp plugin update shared-files updates it.
Check your version
Known vulnerabilities
12 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
medium 6.8 CVE-2026-12513 · published 2026-08-28
Denial of service in Shared Files (older than 1.7.67)
- Affected
- older than 1.7.67
- Fixed in
- 1.7.67
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
medium 5.3 CVE-2026-12514 · published 2026-08-28
Missing authorization check in Shared Files (older than 1.7.67)
- Affected
- older than 1.7.67
- Fixed in
- 1.7.67
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
medium 6.4 CVE-2026-78269 · published 2026-08-24
Server-side request forgery (SSRF) in Shared Files (1.7.69 and older)
- Affected
- 1.7.69 and older
- Fixed in
- 1.7.70
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
high 7.5 CVE-2026-49112 · published 2026-06-15
Path traversal / file read in Shared Files (1.7.64 and older)
- Affected
- 1.7.64 and older
- Fixed in
- 1.7.65
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.
medium 6.8 CVE-2025-15433 · published 2026-03-26
Path traversal / file read in Shared Files (older than 1.7.58)
- Affected
- older than 1.7.58
- Fixed in
- 1.7.58
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector
medium 5.3 CVE-2024-34438 · published 2026-02-20
Missing authorization check in Shared Files (1.7.19 and older)
- Affected
- 1.7.19 and older
- Fixed in
- 1.7.20
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.
high 7.2 CVE-2025-4392 · published 2025-06-03
Stored cross-site scripting (XSS) in Shared Files (1.7.48 and older)
- Affected
- 1.7.48 and older
- Fixed in
- 1.7.60 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, and including, 1.7.48 due to insufficient input sanitization and output escaping within the sanitize_file() function. This makes it possible for unauthenticated attackers to bypass the plugin’s MIME-only checks and inject arbitrary web scripts in pages that will execute whenever a user accesses the html file.
NVD CVE-2025-4392Wordfence advisoryCode change (fix)wordpress.orggithub.com
high 7.2 CVE-2024-13504 · published 2025-01-31
Stored cross-site scripting (XSS) in Shared Files (1.7.42 and older)
- Affected
- 1.7.42 and older
- Fixed in
- 1.7.60 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default.
NVD CVE-2024-13504Wordfence advisoryCode change (fix)Plugin source
high 7.5 CVE-2024-43230 · published 2024-08-26
Information disclosure in Shared Files (1.7.28 and older)
- Affected
- 1.7.28 and older
- Fixed in
- 1.7.29
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.
medium 5.3 CVE-2024-32679 · published 2024-04-23
Missing authorization check in Shared Files (1.7.16 and older)
- Affected
- 1.7.16 and older
- Fixed in
- 1.7.17
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.16.
medium 6.1 CVE-2023-4819 · published 2023-10-16
Security issue in Shared Files (older than 1.7.6)
- Affected
- older than 1.7.6
- Fixed in
- 1.7.6
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts.
medium 4.8 CVE-2021-24856 · published 2021-11-17
Cross-site scripting (XSS) in Shared Files (older than 1.6.61)
- Affected
- older than 1.6.61
- Fixed in
- 1.6.61
- Access needed (per CVSS)
- Needs an admin-level account; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Recent activity
- 2026-10-21 — latest release on wordpress.org (1.7.72).
- 2026-08-28 — Denial of service disclosed (CVE-2026-12513), fixed in 1.7.67.
- 2026-08-28 — Missing authorization check disclosed (CVE-2026-12514), fixed in 1.7.67.
- 2026-08-24 — Server-side request forgery (SSRF) disclosed (CVE-2026-78269), fixed in 1.7.70.
Get an email when Shared Files has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Shared Files (shared-files) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by Anssi Laitila (2 tracked)
Types found in this plugin: Missing authorization (3) · Cross-site scripting (XSS) (3) · Path traversal and file read (2) · Denial of service (1) · Server-side request forgery (SSRF) (1) · Sensitive data exposure (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/shared-files (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/shared-files"><img src="https://laskyr.com/plugins/shared-files/badge.svg" alt="Shared Files vulnerability status"></a>