CVE-2025-15433

Medium · 6.8

CVSS

6.8

EPSS

0.4%

Published

Mar 26, 2026

CISA due date

—

The record

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector

Affected packages

Ecosystem	Package	Introduced	Fixed