CVE-2025-15433: Unknown Shared Files

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector

Affected products

• Unknown Shared Files: before 1.7.58 (fixed in 1.7.58)

Published 2026-03-26. Last modified 2026-06-17.