Answer in brief
CVE-2026-12513 records a Unknown severity vulnerability in Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal. The current sources do not mark it as known exploited. The current feed maps Unknown/Shared Files (generic), Unknown/shared-files-pro (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Shared Files (generic), Unknown/shared-files-pro (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Shared Filesgeneric | >=0 <1.7.67 | 1.7.67 |
| Unknown/shared-files-progeneric | >=0 <1.7.68 | 1.7.68 |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
Quoted source text, attributed separately from HOL analysis.