The vulnerability arises because the plugin’s file‑upload handler does not enforce a capability check, allowing any visitor to reach the upload endpoint. The handler is bound to unauthenticated users and protected only by a nonce generated on public pages; thus an attacker can submit an upload request without authenticating. The upload is restricted to MIME types allowed by WordPress, which prevents the placement of executable PHP files, but the response reveals the server’s absolute path, giving information that may assist further attacks.

The affected products are the Shared Files plugin before version 1.7.67 and the shared‑files‑pro plugin before version 1.7.70. These plugins are available from unknown vendors and are commonly used in WordPress installations that have these versions installed.

Because the attack is unauthenticated, any external user can exploit it; however, only non‑executable file types can be uploaded, so immediate remote code execution is not possible. The vulnerability does not appear in the CISA KEV catalog and there is no EPSS information available, so exploitation risk is considered low to moderate, but the disclosed server path information can be leveraged in subsequent attacks. The lack of a formal CVSS score limits the ability to quantify risk precisely, but the potential for information disclosure warrants attention.