---
id: CVE-2026-85576
title: >-
  The All in One Files Upload WordPress plugin before 2.0.17 does not have any
  capability check, and does not verify the authenticity of the request, when
  saving its settings, allowing any authenticated user, such as a subscriber, to
  chang…
summary: >-
  The All in One Files Upload WordPress plugin before 2.0.17 does not have any
  capability check, and does not verify the authenticity of the request, when
  saving its settings, allowing any authenticated user, such as a subscriber, to
  chang…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
product: All in One Files Upload
affected:
  - all_in_one_files_upload < 2.0.17
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T16:28:31.510'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85576'
references:
  - url: 'https://wpscan.com/vulnerability/5c4546f4-fa6f-47a5-9d2b-9493d34dc13d/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00152
epssPercentile: 0.043
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-30T13:24:48.398755Z'
ingestedAt: '2026-09-30T06:58:55.553Z'
---

## Overview

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.