CVE-2026-80494 in Yogeta WP Cloud Plugin
Summary
by MITRE • 09/12/2026
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The Yogeta WP Cloud WordPress plugin version 1.0 contains a critical Local File Inclusion vulnerability stemming from insufficient input validation and missing access controls on public-facing endpoints. This flaw allows an unauthenticated attacker to exploit the application's file handling mechanisms by supplying arbitrary, user-controlled paths that are directly passed to underlying server-side functions responsible for reading files. Because the endpoint lacks any form of authentication or authorization checks, there is no barrier preventing external actors from initiating these requests, effectively turning a standard file retrieval feature into a vector for unauthorized data access.
From a technical perspective, the core issue lies in the failure to sanitize or validate the user-supplied file path parameter before it is processed by the server's filesystem operations. In many WordPress plugins, such functionality might be intended for legitimate purposes like serving media files or configuration backups, but without proper boundary checks against directory traversal sequences or absolute path restrictions, attackers can manipulate the input to escape the intended web root. This allows them to reference sensitive system files located outside of the public document root, including database configuration files that typically store plaintext credentials such as MySQL usernames and passwords, SSH keys, API tokens, and other secrets essential for maintaining infrastructure security.
The operational impact of this vulnerability is severe, as it facilitates complete compromise of the affected WordPress installation and potentially the underlying server environment. By downloading sensitive credential files, an attacker can gain unauthorized access to the database backend, allowing them to extract user data, modify site content, or escalate privileges within the application itself. Furthermore, if these credentials are reused across other systems or services due to poor password hygiene common in many deployments, the breach extends beyond the immediate WordPress instance into broader organizational networks. This scenario aligns with CWE-20 Improper Input Validation and CWE-538 Insertion of Sensitive Information into Log File when sensitive data is inadvertently exposed through file reads, as well as ATT&CK technique T1005 Data from Local System which describes the adversary's goal of collecting data directly from local sources.
To mitigate this vulnerability, immediate remediation steps should include updating the Yogeta WP Cloud plugin to a patched version that implements strict input validation and enforces authorization checks on all endpoints handling file operations. If an update is not immediately available, administrators should restrict access to any public-facing scripts associated with the plugin using web server configuration rules or firewall policies until the patch is applied. Additionally, implementing principle of least privilege for file system permissions ensures that even if a path traversal occurs, the process running the WordPress application does not have read access to critical sensitive files outside its designated scope. Regular security audits and code reviews focusing on input validation patterns are recommended to prevent similar flaws in future development cycles.