CVE Feed

    Dashboard / CVE / CVE-2026-93031

    CVE-2026-93031

    The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

    Published:Sep 18, 2026
    Last Modified:Sep 19, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.00584
    CVSS Score:8.8

    Affected Products

    Vendor
    Deleeuw
    Product
    Share-one-drive | Onedrive & Sharepoint Plugin For Wordpress
    Vendor
    Deleeuw
    Product
    Wp Cloud Plugins - Box (lets-box)
    Vendor
    Deleeuw
    Product
    Wp Cloud Plugins - Dropbox (out-of-the-box)
    Vendor
    Wordpress
    Product
    Wordpress
    Vendor
    Wp Cloud Plugins/ Deleeuw
    Product
    Use-your-drive | Google Drive Plugin For Wordpress

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High