Read the docs
TI-2026-62656 Aliases CVE-2026-93031GHSA-v278-3mjv-f38g

Unrestricted file upload in WP Cloud Plugins/_deleeuw_ Use-your-Drive | Google Drive…

Priority MEDIUM 41CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WP Cloud Plugins/_deleeuw_Use-your-Drive | Google Drive plugin for WordPress2.0 – 3.8.3—No fix listedCNA
_DeLeeuw_Share-one-Drive | OneDrive & SharePoint plugin for WordPress2.0 – 3.8.3—No fix listedCNA
_DeLeeuw_WP Cloud Plugins - Box (Lets-Box)2.0 – 3.8.3—No fix listedCNA
_DeLeeuw_WP Cloud Plugins - Dropbox (Out-of-the-Box)2.0 – 3.8.3—No fix listedCNA
  • Use-your-Drive | Google Drive plugin for WordPress VendorWP Cloud Plugins/_deleeuw_ Affected 2.0 – 3.8.3 Fixed in — No fix listed CNA
  • Share-one-Drive | OneDrive & SharePoint plugin for WordPress Vendor_DeLeeuw_ Affected 2.0 – 3.8.3 Fixed in — No fix listed CNA
  • WP Cloud Plugins - Box (Lets-Box) Vendor_DeLeeuw_ Affected 2.0 – 3.8.3 Fixed in — No fix listed CNA
  • WP Cloud Plugins - Dropbox (Out-of-the-Box) Vendor_DeLeeuw_ Affected 2.0 – 3.8.3 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93031
  2. 2026-10-03 Alias added: GHSA-v278-3mjv-f38g

References

Other 3

  • TI-2025-06413 Cross-site scripting in WP Cloud Plugins/_deleeuw_ Use-your-Drive | Google Drive plugin… CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences