CVE-2026-15958 — CRITICAL (9.3)

Vulnerability Description

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

CVSS Score

9.3

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-862

References

https://wpscan.com/vulnerability/e424157e-b79f-4000-8dcc-51413581fdec/

FAQ

What is CVE-2026-15958?

CVE-2026-15958 is a vulnerability with a CVSS score of 9.3 (CRITICAL). The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, a...

How severe is CVE-2026-15958?

CVE-2026-15958 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-15958?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.