The shared-files‑pro WordPress plugin allows users to set a featured image by providing a file path. The plugin fails to validate this path, enabling attackers to read any file on the server and publish its contents under a public URL. This results in disclosure of confidential data, potential leakage of credentials, and indirect exposure of the site to further attacks. The weakness falls under Improper Input Validation (CWE-20), Path Traversal (CWE-22), and arbitrary file read (CWE-73).

Any WordPress site that has the shared‑files‑pro plugin installed with a version earlier than 1.7.70 is affected. The vendor is unknown; the product name is shared‑files‑pro. No specific release notes are listed, so all prior releases are considered vulnerable until a fixed version is released.

The vulnerability can be exploited without authentication by sending a crafted request to the plugin’s featured‑image endpoint, supplying an arbitrary path such as ../../../../etc/passwd. Because it is triggered via a public endpoint, attackers with basic network access can retrieve any readable file. The EPSS score is less than 1% and the lack of requirement for privileged execution combined with the ability to read any file makes this a high‑risk flaw. The vulnerability is not listed in the CISA KEV catalog, but given its nature and the potential impact, it should be treated as a severe threat.