CVE-2026-93031High· 8.8▾ Twilight

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads functi…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score49/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 18, 2026

Updated

Sep 21, 2026

CVSS

8.8

Vendor

WP Cloud Plugins/_deleeuw_

Product

Use-your-Drive | Google Drive plugin for WordPress

CWE

CWE-434

Depth score

49 · Moderate

EPSS

0.58% · p48

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-09-19

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

0.6% → 0.6%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 7 days

Sep 18, 2026Published
Disclosed via NVD
Sep 19, 2026EPSS first tracked
0.6%
Sep 21, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS peak
0.6% → 1.0%

WP Cloud Plugins/_deleeuw_CWE-434 #nvd #cve.org

Affected

use-your-drive_google_drive_plugin_for_wordpress >= 2.0 <= 3.8.3
share-one-drive_onedrive_sharepoint_plugin_for_wordpress >= 2.0 <= 3.8.3
wp_cloud_plugins_-_box_lets-box >= 2.0 <= 3.8.3
wp_cloud_plugins_-_dropbox_out-of-the-box >= 2.0 <= 3.8.3

Full technical detail▾

Overview

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed