The All in One Files Upload WordPress plugin, versions prior to 2.0.17, lacks a capability check and fails to verify the authenticity of requests when saving settings. This flaw permits any authenticated user—such as a subscriber—to change the plugin’s arbitrary configuration parameters. The impact is a privilege escalation opening the door for covert manipulation of how the plugin operates, potentially altering file handling behavior, permissions, or exposing sensitive data. The core weakness corresponds to improper authorization.

WordPress sites that have the All in One Files Upload plugin installed with a version older than 2.0.17 are affected. The vendor is unknown, but the plugin name is All in One Files Upload. Users should review the installed plugin version and ensure it is up‑to‑date.

The CVSS score is 4.3, and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is exploitable via standard HTTP requests to the plugin’s settings endpoint and requires only that the attacker possess any authenticated WordPress role. Because the attacker only needs an account such as Subscriber, the vulnerability is relatively low in exploitation difficulty, yet the potential impact of up‑grading privileges or misconfiguring file handling warrants prompt attention.