{"id":"CVE-2026-15958","published":"2026-08-04T07:16:29.257","lastModified":"2026-08-04T18:16:45.220","description":"The Easy Integration for Dropbox  WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e424157e-b79f-4000-8dcc-51413581fdec/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to perform file management actions on connected Dropbox accounts, leading to unauthorized access and data exposure.","exploitability":"Exploitation is relatively easy as no authentication is required for certain AJAX actions.","blast_radius":"If exploited, it could result in significant data breaches affecting both user files and administrative information.","remediation":"Update the Easy Integration for Dropbox WordPress plugin to version 2.2.0 or later immediately.","tags":["auth-bypass","web","data-exposure","file-management"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:44:00.728Z"}}