CVE-2026-93031 Details
Description
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
A vulnerability allowing arbitrary file upload has been identified in the WP Cloud Plugins 'Use-your-Drive', 'Out-of-the-Box', 'Share-one-Drive', and 'Lets-Box' plugins for WordPress. This vulnerability exists in all versions from 2.0 up to and including 3.8.3. The issue arises in the 'download_file_to_uploads' function, where the import action is available to unauthenticated users through 'wp_ajax_nopriv_'. Additionally, there is a lack of capability checks in the 'can_import()' function, and the extensions and contents of imported files are not properly validated against 'get_allowed_mime_types()' before being saved to the uploads directory. As a result, authenticated attackers with subscriber-level access or higher can upload potentially executable files, leading to remote code execution.
Users are advised to update to version 3.9.0 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP Cloud Plugins Use-your-Drive | >= 2.0, <= 3.8.3 |
CPE
Remediation
| |
| WP Cloud Plugins Out-of-the-Box | >= 2.0, <= 3.8.3 |
CPE
Remediation
| |
| WP Cloud Plugins Share-one-Drive | >= 2.0, <= 3.8.3 |
CPE
Remediation
| |
| WP Cloud Plugins Lets-Box | >= 2.0, <= 3.8.3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |