{"id":"CVE-2025-15433","aliases":["EUVD-2025-209042","GHSA-fwg5-qqw8-5x24"],"status":"published","title":"Shared Files \u003c 1.7.58 - Contributor+ Arbitrary File Download","description":"The Shared Files  WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00437,"percentile":0.38277,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-03-26T06:00:07Z","modified":"2026-06-17T08:37:45Z","products":[{"vendor":"unknown","product":"shared files"}],"references":[{"url":"https://wpscan.com/vulnerability/893667a1-dc8f-476a-ac00-55752fface90/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15433"},{"url":"https://wpscan.com/vulnerability/893667a1-dc8f-476a-ac00-55752fface90"},{"url":"https://github.com/advisories/GHSA-fwg5-qqw8-5x24"}],"sources":{"cve":[{"id":"CVE-2025-15433","title":"Shared Files \u003c 1.7.58 - Contributor+ Arbitrary File Download","description":"The Shared Files  WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector","status":"published","published":"2026-03-26T06:00:07.315Z","modified":"2026-03-26T13:35:20.136Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-209042","description":"The Shared Files  WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector","status":"published","published":"2026-03-26T06:00:07Z","modified":"2026-03-26T13:35:20Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:28.569748Z"}],"ghsa":[{"id":"GHSA-fwg5-qqw8-5x24","title":"The Shared Files  WordPress plugin before 1.7.58 allows users with a role as low as Contributor...","description":"The Shared Files  WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector","status":"published","published":"2026-03-26T09:30:27Z","modified":"2026-03-26T15:31:39Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:06:52.998793Z"}],"nvd":[{"id":"CVE-2025-15433","description":"The Shared Files  WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector","status":"published","published":"2026-03-26T07:16:19.133Z","modified":"2026-06-17T08:37:45.94Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:01.641503Z"}]}}