CVE-2026-19084

The Shared Files Pro WordPress plugin before version 1.7.70 fails to validate the file path supplied when creating a featured image (CWE-73, externally controlled file name or path). An unauthenticated attacker can trigger the featured-image creation routine with an attacker-chosen path, causing the plugin to read an arbitrary file from the server. The contents of that file are then republished at a public URL, so an attacker can exfiltrate sensitive server-side files — such as configuration files or credentials — without any account or user interaction. Any WordPress site running an affected version of the plugin is exposed. There is no known public proof-of-concept, the flaw is not in CISA KEV, and the low EPSS score (0.3%, 24th percentile) indicates exploitation is not yet widely expected, though no active exploitation has been ruled out.

What to do: Update Shared Files Pro to version 1.7.70 or later. Until patched, consider blocking or restricting unauthenticated access to the plugin's featured-image endpoint via a WAF or web-server rules. Afterwards, review web-server access logs for unauthenticated requests to that feature and treat any sensitive local file (e.g., wp-config.php or files containing secrets) as potentially exposed, rotating credentials if suspicious activity is found.