What is GHSA-4qpc-6xpr-g8g2?

GHSA-4qpc-6xpr-g8g2 is a security advisory published by GitHub Security Advisories with Medium severity. The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70...

Which CVE IDs does GHSA-4qpc-6xpr-g8g2 cover?

GHSA-4qpc-6xpr-g8g2 covers the following CVE IDs: CVE-2026-12514. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4qpc-6xpr-g8g2?

GHSA-4qpc-6xpr-g8g2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-4qpc-6xpr-g8g2MediumCVSS 5.3

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-12514 →

📋 Description

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12514
https://wpscan.com/vulnerability/a3098be8-aa7a-48ef-9fcc-b67c763debba
https://github.com/advisories/GHSA-4qpc-6xpr-g8g2