CVE-2025-15433: 
WordPress vulnerability analysis and mitigation

CVE-2025-15433 is a path traversal vulnerability in the Shared Files WordPress plugin (versions before 1.7.58) that allows authenticated users with a role as low as Contributor to download arbitrary files from the web server, including sensitive files such as wp-config.php. The vulnerability was publicly disclosed on March 5, 2026, and assigned by WPScan. It carries a CVSS v3.1 base score of 6.8 (Medium) (WPScan).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 — Path Traversal), classified under OWASP Top 10 A1: Injection. The plugin fails to sanitize or validate the _sf_file_uploaded_file POST parameter when a Contributor creates or edits a Shared File entry, allowing the attacker to supply a path traversal sequence (e.g., /var/www/html/../../../wp-config.php) to reference arbitrary server-side files. Once the file entry is published (by an admin), the public download link at /shared-files/[POST_ID] serves the traversed file directly to the requester. A proof-of-concept is publicly documented by the original researcher, Muhammad Rohan Khan (WPScan).

Successful exploitation allows a low-privileged authenticated attacker (Contributor role) to read and download any file accessible to the web server process, including wp-config.php, which typically contains database credentials, authentication keys, and salts. Exposure of these credentials can lead to full database compromise, WordPress admin account takeover, and potential lateral movement within the hosting environment. Confidentiality is the primary impact; integrity and availability are not directly affected by this vulnerability (WPScan).

A proof-of-concept exploitation procedure is publicly documented on WPScan, lowering the barrier for exploitation. The vulnerability requires a valid Contributor-level account on the target WordPress site, and also requires an admin to publish the malicious file entry — introducing a partial dependency on admin interaction. The EPSS score is approximately 0.021% (very low automated exploitation probability at this time), and the vulnerability does not appear in the CISA KEV catalog. No threat actor attribution or in-the-wild exploitation has been reported (WPScan).

1. Reconnaissance: Identify WordPress sites running the Shared Files plugin at a version below 1.7.58 using tools like WPScan or by checking /wp-content/plugins/shared-files/readme.txt.
2. Obtain Contributor access: Register or use an existing account with at least Contributor privileges on the target site.
3. Create a Shared File entry: Navigate to the WordPress admin panel and initiate adding a new Shared File post.
4. Intercept and modify the upload request: Using a proxy tool (e.g., Burp Suite), intercept the POST request to /wp-admin/post.php and modify the _sf_file_uploaded_file parameter to a path traversal value pointing to the target file (e.g., /var/www/html/../../../wp-config.php).
5. Save the post: Submit the modified request to save the Shared File entry with the traversed path.
6. Admin publishes the file: Wait for or social-engineer an admin to publish the file entry (or if the attacker has editor-level access, publish it directly).
7. Download the target file: Visit the public download URL http://[target]/shared-files/[POST_ID] to download the server file (e.g., wp-config.php) containing sensitive credentials (WPScan).

• Logs: WordPress access logs showing GET requests to /shared-files/[POST_ID] shortly after a Contributor-authored post was published; POST requests to /wp-admin/post.php from Contributor accounts containing path traversal sequences (e.g., ../) in form data.
• File System: Shared Files plugin post metadata containing absolute paths or traversal sequences (e.g., /var/www/html/../../../wp-config.php) stored in the WordPress database (wp_postmeta table, key _sf_file_uploaded_file).
• Network: Outbound or client-side downloads of files with names matching sensitive server files (e.g., wp-config.php) originating from the /shared-files/ URL path.
• Database: Entries in wp_postmeta where meta_key = '_sf_file_uploaded_file' and meta_value contains ../ or absolute paths outside the uploads directory (WPScan).

Update the Shared Files WordPress plugin to version 1.7.58 or later, which contains the fix for this path traversal vulnerability. No official configuration-based workaround has been published; the recommended action is immediate plugin update. Site administrators should also audit the wp_postmeta table for any existing entries with path traversal sequences in the _sf_file_uploaded_file field, and rotate wp-config.php credentials (database password, secret keys/salts) if exploitation is suspected (WPScan).

The vulnerability was reported and verified by independent researcher Muhammad Rohan Khan and submitted through WPScan's responsible disclosure process. A brief post was noted on Bluesky via the CVE tracking account, and the vulnerability was indexed by multiple CVE aggregators (VulDB, CVEFeed, ENISA EUVD). No major vendor statements or significant media coverage beyond standard vulnerability database entries have been identified (WPScan).