blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-85576

MEDIUM 4.3 CVSS 3.1
Published
September 30, 2026
Last modified
September 30, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.

Affected products and versions

  • Unknown All in One Files Upload — Before 2.0.17

References

  • wpscan.com https://wpscan.com/vulnerability/5c4546f4-fa6f-47a5-9d2b-9493d34dc13d/
  • nvd.nist.gov Official NVD record