EUVD-2026-50114
GHSA-fj8r-hgww-qgmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with vulnerable addon and cloud storage configured
-
DeliverySend crafted request to unauthenticated AJAX action
-
ExploitInject traversal path or internal URL into file-read parameter
-
ExecutionServer reads local file or fetches attacker URL
-
ImpactExfiltrate wp-config.php or pivot via SSRF
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has an active cloud-storage connection configured through the WP Media Folder Addon (e.g. Google Drive, Dropbox, OneDrive, or S3) - without a configured connection the vulnerable code paths are not reachable, which is the primary limiting factor. Given that precondition, no authentication is required (CVSS PR:N confirms unauthenticated), no user interaction is needed (UI:N), and the two affected AJAX actions are exposed to unauthenticated (nopriv) users over the network. The attack targets the specific user-supplied path parameter in the still-unpatched cloud-storage handlers left exposed after the incomplete CVE-2026-9690 fix; the flaw is limited to plugin versions through 4.1.6. |
| Impact | The CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and a scope change (SSRF reaching adjacent systems), but no integrity or availability impact. Publicly available exploit code raises real-world risk beyond a theoretical high-CVSS issue, and the flaw being an incomplete fix of CVE-2026-9690 means an established exploitation pattern already exists for this handler family. The critical mitigating factor is that exploitation requires a cloud-storage connection to have been configured on the target site - a non-default deployment state - so the exposed population is a subset of all installs. No EPSS score was provided in the input, and no SSVC decision data was supplied, so automatability and exploitation-status framing cannot be independently corroborated; this is a data gap. The vulnerability is not in CISA KEV, so despite public POC there is no confirmation of active exploitation - treat as high priority for sites using cloud storage, lower for default installs. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running WP Media Folder Addon <=4.1.6 with a cloud-storage connection enabled, then sends a crafted request to one of the two vulnerable admin-ajax.php actions supplying a local path (e.g. ../../../wp-config.php) to exfiltrate database credentials, or an internal URL (e.g. http://169.254.169.254/ metadata endpoints) to pivot via SSRF into cloud metadata or internal services. Public exploit code exists, and the low attack complexity (AC:L, no user interaction) makes mass scanning practical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
RemediationAI
No fix version is stated in the provided data; the plugin is reported vulnerable through 4.1.6, so upgrade to the first release above 4.1.6 that the vendor publishes addressing all cloud-storage handlers (verify against the WPScan advisory at https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26/ before deploying) - no vendor-released patched version is independently confirmed at time of analysis. Because the prior patch for CVE-2026-9690 was incomplete, confirm the chosen release explicitly covers the remaining handlers. As a compensating control until a verified patch is applied, disable or remove any cloud-storage connection in the addon, which eliminates the exploit precondition at the cost of losing cloud-media functionality; alternatively restrict access to wp-admin/admin-ajax.php for the affected nopriv actions via a WAF rule or block the specific vulnerable AJAX action names, accepting that overly broad admin-ajax filtering can break other plugins. If cloud storage is not needed, deactivating the addon entirely is the safest option.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WP Media Folder Addon, an extension to the WP Media Folder media-library plugin that adds integrations with external cloud object stores (e.g. Google Drive, Dropbox, OneDrive, Amazon S3). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): two AJAX actions exposed to unauthenticated users (WordPress admin-ajax.php nopriv hooks) take a user-controlled parameter and pass it directly into a file/URL read operation used by the cloud-storage handlers without canonicalization or allow-list validation. Because that read primitive can target both local filesystem paths and remote URLs, the same flaw yields both Arbitrary File Disclosure (reading files like wp-config.php) and Server-Side Request Forgery (making the server fetch attacker-chosen URLs). The CPE (cpe:2.3:a:unknown:wp-media-folder-addon) confirms the plugin as the sole affected product; the vendor is JoomUnited.
Know when Wp Media Folder Addon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network-reachable AJAX action (PR:N/AV:N/AC:L), SSRF crosses trust boundary so S:C, file disclosure gives C:H with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.
Executive ViewAI
The WP Media Folder Addon WordPress plugin (versions through 4.1.6) enables unauthenticated attackers to read sensitive files from affected servers, creating immediate data breach and compliance exposure. Organizations using this plugin with cloud storage connections are at risk, and publicly available exploit code exists. Leadership must prioritize urgent inventory and deployment of interim controls while awaiting vendor patch availability.
Disable WP Media Folder Addon plugin entirely until patch availability; alternatively, disable cloud storage handler functionality and implement strict input validation on all media path parameters; deploy WAF rules to block malicious AJAX requests; restrict wp-admin/admin-ajax.php access to known trusted IP ranges and require multi-factor authentication for administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB