CVE-2026-19084: Unknown Shared-Files-Pro

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

Affected products

• Unknown Shared-Files-Pro: before 1.7.70 (fixed in 1.7.70)

Published 2026-08-28. Last modified 2026-08-28.