CVE-2026-19084 — Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary…
Published: 2026-08-28 · CVSS: 7.5 · CVSS 3.1
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7