CVE-2026-85576 — All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

CVE-2026-85576

All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update PUBLISHED

Description (CNA)

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.

Affected (CNA)

Vendor / product	Versions
Unknown / All in One Files Upload	affected 0 before 2.0.17

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/5c4546f4-fa6f-47a5-9d2b-9493d34dc13d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.