← Back to the live CVE advisory feed

CVE-2026-93031: Use-your-Drive | Google Drive plugin for WordPress

Severity

8.8 (HIGH)

Vendor

WP CLOUD PLUGINS/ DELEEUW

Affected versions

2.0 through 3.8.3

Patch status

Unknown

Published

2026-09-18T20:17:31.630

Modified

2026-09-18T20:17:31.630

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.

View the official NVD record for CVE-2026-93031

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.