CVE-2026-85576

The All in One Files Upload WordPress plugin (versions before 2.0.17 ) is vulnerable to unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify request authenticity when saving plugin settings. This allows any authenticated user , such as a subscr...