CyberRota Analysis
AI-GeneratedThe Shared Files and shared-files-pro WordPress plugins prior to their respective versions are vulnerable due to inadequate sanitization of file paths from frontend submissions, allowing unauthenticated users to exploit a bypass in the traversal filter. This vulnerability can lead to the deletion of arbitrary files on the server, including critical files like wp-config.php, resulting in denial of service and potential site takeover. WordPress site administrators using these plugins should prioritize immediate updates to mitigate this risk.
Original NVD Description
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.