EUVD-2026-50114
GHSA-fj8r-hgww-qgmw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network-reachable AJAX action (PR:N/AV:N/AC:L), SSRF crosses trust boundary so S:C, file disclosure gives C:H with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.
AnalysisAI
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has an active cloud-storage connection configured through the WP Media Folder Addon (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and a scope change (SSRF reaching adjacent systems), but no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running WP Media Folder Addon <=4.1.6 with a cloud-storage connection enabled, then sends a crafted request to one of the two vulnerable admin-ajax.php actions supplying a local path (e.g. ../../../wp-config.php) to exfiltrate database credentials, or an internal URL (e.g. … |
| Remediation | No fix version is stated in the provided data; the plugin is reported vulnerable through 4.1.6, so upgrade to the first release above 4.1.6 that the vendor publishes addressing all cloud-storage handlers (verify against the WPScan advisory at https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26/ before deploying) - no vendor-released patched version is independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations running WP Media Folder Addon version 4.1.6 or earlier with cloud storage configured; document inventory with storage provider types; deploy Web Application Firewall (WAF) blocks on AJAX handlers serving the vulnerable endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Media Folder Addon
View allSame weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today