Shared Files <= 1.7.16 - Missing Authorization to Notice Dismissal

Wordfence Intelligence   >   Vulnerability Database   >   Shared Files <= 1.7.16 - Missing Authorization to Notice Dismissal
5.3
Missing Authorization
CVE CVE-2024-32679
CVSS 5.3 (Medium)
Publicly Published April 17, 2024
Last Updated April 23, 2024
Researcher Dhabaleshwar Das

Description

The Shared Files plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_notifications function in versions up to, and including, 1.7.16. This makes it possible for unauthenticated attackers to dismiss notices.

References

Share

Vulnerability Details for Shared Files – File Upload & Download Manager

Shared Files – File Upload & Download Manager

Software Type Plugin
Software Slug shared-files (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.7.17, or a newer patched version
Affected Version
  • <= 1.7.16
Patched Version
  • 1.7.17

Recent vulnerabilities in Shared Files – File Upload & Download Manager

Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.64 - Unauthenticated Path Traversal
5.3
CVE-2026-49112
Jun 5, 2026
Researcher: kai63001
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
4.3
CVE-2025-15433
Mar 30, 2026
Researcher: Muhammad Rohan Khan
Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function
7.2
CVE-2025-4392
Jun 2, 2025
Researcher: Martin Martin
Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Upload
7.2
CVE-2024-13504
Jan 30, 2025
Researcher: Tim Coen
Shared Files <= 1.7.28 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2024-43230
Aug 9, 2024
Researcher: Abdi Pranata
Shared Files <= 1.7.19 - Missing Authorization
5.3
CVE-2024-34438
May 7, 2024
Researcher: domiee13
Shared Files <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2023-4819
Sep 21, 2023
Researcher: Zeyad Alshahrani
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
Freemius SDK <= 2.4.2 - Missing Authorization Checks
6.3
CVE-2022-4974
Mar 4, 2022
Researchers:
Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload <= 1.6.60 - Cross-Site Scripting
4.8
CVE-2021-24856
Oct 18, 2021
Researcher: Kévin Mosbahi (Mika)
# Title CVE ID CVSS Researchers Date
1 Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.64 - Unauthenticated Path Traversal CVE-2026-49112 5.3 kai63001 June 5, 2026
2 Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download CVE-2025-15433 4.3 Muhammad Rohan Khan March 30, 2026
3 Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function CVE-2025-4392 7.2 Martin Martin June 2, 2025
4 Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Upload CVE-2024-13504 7.2 Tim Coen January 30, 2025
5 Shared Files <= 1.7.28 - Unauthenticated Sensitive Information Exposure CVE-2024-43230 5.3 Abdi Pranata August 9, 2024
6 Shared Files <= 1.7.19 - Missing Authorization CVE-2024-34438 5.3 domiee13 May 7, 2024
7 Shared Files <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting CVE-2023-4819 7.2 Zeyad Alshahrani September 21, 2023
8 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
9 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 March 4, 2022
10 Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload <= 1.6.60 - Cross-Site Scripting CVE-2021-24856 4.8 Kévin Mosbahi (Mika) October 18, 2021
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation