CVE-2026-11974 in Wp Media Folder Addon Plugin
Summary
by MITRE • 07/29/2026
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The wp-media-folder-addon WordPress plugin version 4.1.6 contains a critical security vulnerability that stems from insufficient input validation in two AJAX endpoints accessible to unauthenticated users. This flaw enables attackers to perform arbitrary file disclosure and server-side request forgery attacks when cloud storage connections are configured on the target system. The vulnerability represents an incomplete remediation of CVE-2026-9690, where only one of multiple affected cloud-storage handlers received proper patching while others remained exposed to exploitation. The security issue manifests through improper parameter validation in the plugin's file read operations, creating a pathway for malicious actors to access sensitive files on the server and potentially leverage server-side request forgery to interact with internal systems.
The technical implementation of this vulnerability involves two specific AJAX actions that lack adequate sanitization of user-supplied parameters before these values are utilized in file system operations. When cloud storage integration is configured, these unvalidated inputs can be manipulated to traverse file system paths or redirect requests to unintended destinations. The flaw directly maps to CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-918 Server-Side Request Forgery, both of which are well-documented in the Common Weakness Enumeration catalog. Attackers can exploit this vulnerability without authentication credentials by crafting malicious requests that target the exposed AJAX endpoints, potentially allowing them to read arbitrary files from the server filesystem or force the application to make unauthorized requests to internal services.
The operational impact of this vulnerability extends beyond simple information disclosure, as it creates potential for broader compromise when cloud storage configurations are present. An attacker who successfully exploits this flaw can access sensitive configuration files, database credentials, or other system artifacts that may exist in the file system. The server-side request forgery component specifically enables attackers to perform reconnaissance on internal network services or potentially exploit other vulnerabilities within the internal infrastructure. This vulnerability aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS and T1566.001 Phishing: Spearphishing Attachment, as it can be leveraged for initial access and lateral movement through file system enumeration and internal network interaction.
Organizations using the wp-media-folder-addon plugin should immediately implement mitigations to address this vulnerability, including applying the latest available patch that properly addresses all affected cloud-storage handlers. The recommended approach involves validating all user-supplied parameters against a whitelist of acceptable values before processing them in file operations or network requests. Additionally, implementing network-level restrictions to limit access to AJAX endpoints and monitoring for suspicious file read patterns can help detect exploitation attempts. Security teams should conduct thorough audits of all WordPress plugins to identify similar incomplete fixes that may leave other components vulnerable, particularly focusing on cloud storage integrations where parameter validation is critical. The vulnerability demonstrates the importance of comprehensive patch management and thorough testing of security updates to ensure all attack vectors are properly addressed in remediation efforts.