CVE-2026-11974

HIGH8.6

Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

Published Jul 29, 2026

Modified 1 weeks ago

Details

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

References

DETECTION

https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-11974

CVSS Analysis

CVSS v3.1

8.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

8.6/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Ecosystems

Timeline

PublishedJul 29, 2026

ModifiedAug 10, 2026