CVE-2026-118075 in Media Folders Plugin
Summary
by MITRE • 10/29/2026
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified as Contributor PHP Object Injection within the WordPress plugin "WP Media" prior to version 1.1.10 represents a critical server-side code execution risk stemming from improper handling of user-supplied input during file upload operations. This flaw is rooted in the application's failure to adequately sanitize or validate data before it is processed by internal functions that may invoke PHP serialization mechanisms. In many WordPress plugins, media management features allow users to upload files which are then stored and referenced within the database or filesystem. When these references involve serialized objects, an attacker can exploit weak validation checks to inject maliciously crafted payloads into the input fields associated with file metadata or configuration settings.
From a technical perspective, this vulnerability aligns closely with CWE-502, Deserialization of Untrusted Data. The core issue lies in the fact that PHP's unserialize function is being called on data derived from user-controlled sources without sufficient integrity verification. If an attacker can manipulate the serialized string passed to these functions, they may achieve arbitrary object instantiation within the application context. This process often involves crafting a gadget chain where existing classes and their methods are chained together to perform unintended actions, such as executing system commands or accessing sensitive files. The lack of strict type checking allows for the injection of objects that override default behaviors defined in the plugin's codebase.
The operational impact of this vulnerability is severe due to its potential for remote code execution without authentication if the upload functionality is accessible to contributors or subscribers, which are common roles in WordPress installations. An attacker who successfully exploits this flaw can gain full control over the web server hosting the application. This level of access enables the deployment of backdoors, defacement of websites, theft of sensitive data including database credentials and user information, and further lateral movement within the internal network infrastructure. The persistence achieved through such an exploit makes it particularly dangerous for long-term compromise scenarios where attackers maintain stealthy access to critical systems.
This vulnerability is also associated with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used in conjunction with server-side script interpretation like PHP. Furthermore, the exploitation vector often relates to CWE-284, Improper Access Control, as it may bypass intended restrictions on who can modify certain settings or upload files that trigger the deserialization logic. The attack typically requires minimal interaction from the victim beyond having an account with contributor-level privileges or higher, depending on how the plugin restricts access to its media management features.
Mitigation strategies must prioritize immediate remediation by upgrading the WP Media plugin to version 1.1.10 or later where this issue has been addressed through improved input validation and safer handling of serialized data. In environments where updating is not immediately feasible, administrators should consider disabling file upload capabilities for lower-privileged user roles if they are not strictly necessary. Implementing strict Content Security Policies and monitoring server logs for unusual patterns in POST requests related to media uploads can also aid in detecting attempted exploitation. Additionally, employing web application firewalls with rules designed to detect PHP deserialization attacks may provide an additional layer of defense against this specific class of vulnerabilities until a permanent fix is applied across all affected instances.