CVE-2026-19084 — Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read

CVE-2026-19084

Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read PUBLISHED

Description (CNA)

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

Affected (CNA)

Vendor / product	Versions
Unknown / shared-files-pro	affected 0 before 1.7.70

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/48b86169-5ccf-4111-be15-9dd45d478465/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.