CVE-2026-15958

9.3 CRITICAL

Published 2026-08-04 · Updated 2026-08-04

AI risk analysis

Summary: The flaw allows unauthenticated attackers to perform file management actions on connected Dropbox accounts, leading to unauthorized access and data exposure.
Exploitability: Exploitation is relatively easy as no authentication is required for certain AJAX actions.
Blast radius: If exploited, it could result in significant data breaches affecting both user files and administrative information.
Prioritized remediation: Update the Easy Integration for Dropbox WordPress plugin to version 2.2.0 or later immediately.

auth-bypasswebdata-exposurefile-management

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-862

All references

https://wpscan.com/vulnerability/e424157e-b79f-4000-8dcc-51413581fdec/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.