Wp Media Folder Addon
Monthly
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Unauthenticated arbitrary file download in JoomUnited's WP Media Folder Addon WordPress plugin versions 4.0.1 and below allows remote attackers to retrieve arbitrary files from the underlying server via a path traversal weakness (CWE-22). The flaw is exploitable over the network without authentication or user interaction, exposing sensitive WordPress and server files such as wp-config.php. No public exploit identified at time of analysis, and the issue is not currently tracked in CISA KEV.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Unauthenticated arbitrary file download in JoomUnited's WP Media Folder Addon WordPress plugin versions 4.0.1 and below allows remote attackers to retrieve arbitrary files from the underlying server via a path traversal weakness (CWE-22). The flaw is exploitable over the network without authentication or user interaction, exposing sensitive WordPress and server files such as wp-config.php. No public exploit identified at time of analysis, and the issue is not currently tracked in CISA KEV.