CVE-2026-49112: WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability

Synopsis

A path traversal vulnerability affects the Shared Files WordPress plugin at version 1.7.64 and below. The flaw is reachable over the network without any authentication, allowing an unauthenticated remote attacker to request file paths outside the intended directory. Successful exploitation gives the attacker read access to arbitrary files on the server, enabling disclosure of sensitive data such as configuration files, credentials, or private user content. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the traversal request can be sent by any unauthenticated party.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free, requiring only a crafted path string in the request with no race conditions or special environmental factors.

Blast Radius

• Reads arbitrary files from the server filesystem, including WordPress wp-config.php which contains database credentials and authentication secret keys.
• Reads sensitive system files such as /etc/passwd or application environment files that expose infrastructure details.
• Discloses private uploaded content stored outside the web root if the server process has read access to those paths.