The vulnerability arises because the plugin’s file‑upload handler does not enforce a capability check, allowing any visitor to reach the upload endpoint. The handler is bound to unauthenticated users and protected only by a nonce generated on public pages; thus an attacker can submit an upload request without authenticating. The upload is restricted to MIME types allowed by WordPress, which prevents the placement of executable PHP files, but the response reveals the server’s absolute path, giving information that may assist further attacks.

The affected products are the Shared Files plugin before version 1.7.67 and the shared‑files‑pro plugin before version 1.7.70. These plugins are available from unknown vendors and are commonly used in WordPress installations that have these versions installed.

Because the attack is unauthenticated, any external user can exploit it; however, only non‑executable file types can be uploaded, so immediate remote code execution is not possible. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, further indicating limited exposure. Nonetheless, the disclosed server path can assist attackers in staging further attacks, so vigilance is warranted.