## https://sploitus.com/exploit?id=2228AE02-939B-598A-B877-BD93F301E18B
# CVE-2026-12513: Shared Files **Quick Links:** Explore the researcher's official [Cybersecurity Portfolio](https://minhhk.web.app/#writeups) or review the [WPScan Verified Advisory](https://wpscan.com/vulnerability/25c9fa21-c48b-4333-8abc-87230dc4c869/).
---
## 📌 Executive Summary & Technical Metadata
| Parameter | Technical Specification |
| :--- | :--- |
| **Vulnerability Identifier** | `CVE-2026-12513` |
| **Target Software** | Shared Files / Shared Files Pro (WordPress Plugins) |
| **Plugin Slugs** | `shared-files`, `shared-files-pro` |
| **Vulnerable Versions** | `= 1.7.68` |
| **Vulnerability Class** | External Control of File Name or Path / Path Traversal (CWE-73 / CWE-22) |
| **CVSS v3.1 Score** | **6.8 (Medium)** (`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H`) |
| **Discoverer / Researcher** | **Huynh Kien Minh (MinhHK)** |
| **Verification Authority** | WPScan / MITRE Corporation |
| **WPScan Advisory Reference** | [WPScan Report 25c9fa21-c48b-4333-8abc-87230dc4c869](https://wpscan.com/vulnerability/25c9fa21-c48b-4333-8abc-87230dc4c869/) |
| **Researcher Portfolio** | [https://minhhk.web.app/](https://minhhk.web.app/) |
---
## 🔍 Deep-Dive Technical Breakdown & Root Cause Analysis
The vulnerability is rooted in an inadequate path sanitization mechanism implemented within frontend file submission handlers in `Shared Files` (` `../`
- The resulting sanitized path evaluates to: `../../../../wp-config.php`!
### 2. Stored File Path & Deletion Execution Chain
1. **Unauthenticated Submission:** The attacker sends an HTTP request to the frontend upload endpoint providing the nested traversal path. The manipulated path is stored in the database (e.g. in `wp_posts` or custom plugin table).
2. **Permanent Deletion Trigger:** When an administrator reviews submissions or deletes the file record via `/wp-admin/admin.php?page=shared-files`, the backend calls `unlink()` on the resolved stored path:
```php
// Vulnerable deletion logic
$file_to_delete = WP_CONTENT_DIR . '/uploads/shared-files/' . $stored_file_path;
if ( file_exists( $file_to_delete ) ) {
unlink( $file_to_delete ); // Triggers deletion of target file (e.g. /var/www/html/wp-config.php)
}
```
3. **Catastrophic Impact:** Once `wp-config.php` is deleted:
- The database credentials and security keys are lost.
- The site immediately enters an unconfigured state, presenting the WordPress setup wizard (`/wp-admin/install.php`).
- The attacker can complete the setup wizard with a new database, achieving full Remote Code Execution (RCE) and Site Takeover.
---
## 💻 Proof-of-Concept (PoC) Exploit Code
> **Ethical Disclaimer:** This Proof-of-Concept is provided strictly for educational research, defensive validation, and security auditing under ethical disclosure protocols by Huynh Kien Minh.
### Python Exploit PoC (`poc_cve_2026_12513.py`)
```python
#!/usr/bin/env python3
"""
CVE-2026-12513: Shared Files 1 else TARGET_URL
trigger_traversal_payload(url)
```
---
## 🛡️ Remediation & Patch Analysis
### For Site Administrators
- Update the **Shared Files** and **Shared Files Pro** plugins immediately to version **`1.7.68`** or higher.
- Ensure file system permissions on `wp-config.php` are read-only (`chmod 400` or `440`) for the web server process.
### For Developers (The Secure Implementation)
Enforce strict canonical path resolution using `realpath()` and `wp_normalize_path()` to ensure operations remain within the designated uploads boundary:
```php
// Secure Path Validation Pattern (Version 1.7.68+)
function shared_files_safe_delete( $relative_path ) {
$base_dir = wp_normalize_path( WP_CONTENT_DIR . '/uploads/shared-files/' );
$target = wp_normalize_path( realpath( $base_dir . $relative_path ) );
// Ensure the resolved realpath strictly starts with the designated base directory
if ( false === $target || 0 !== strpos( $target, $base_dir ) ) {
wp_die( __( 'Invalid or unauthorized file path.', 'shared-files' ), 403 );
}
if ( file_exists( $target ) && is_file( $target ) ) {
unlink( $target );
}
}
```
---
## 🏆 About the Researcher
**Huynh Kien Minh (MinhHK)** is an Information Security Researcher specializing in WordPress vulnerability research, core & plugin security audits, and defensive exploit modeling.
- **Cybersecurity Portfolio:** [https://minhhk.web.app/](https://minhhk.web.app/)
- **WPScan Advisory Reference:** [WPScan Report 25c9fa21-c48b-4333-8abc-87230dc4c869](https://wpscan.com/vulnerability/25c9fa21-c48b-4333-8abc-87230dc4c869/)
- **GitHub Profile:** [https://github.com/MinhHK68](https://github.com/MinhHK68)
---
## 📊 JSON-LD Structured Data Schema Markup
```json
{
"@context": "https://schema.org",
"@type": "TechArticle",
"headline": "CVE-2026-12513: Shared Files < 1.7.68 Unauthenticated Arbitrary File Deletion via Path Traversal",
"author": {
"@type": "Person",
"name": "Huynh Kien Minh",
"url": "https://minhhk.web.app/"
},
"datePublished": "2026-08-30",
"description": "Technical advisory by Huynh Kien Minh analyzing CVE-2026-12513 in Shared Files WordPress plugin.",
"identifier": "CVE-2026-12513"
}
```