CVE-2026-11974

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

Score
CVSS 3.1 8.6 High
Status
Deferred - contact@wpscan.com
Published
2026-07-29
Last modified
2026-08-10
Weaknesses
CWE-22

Affected products

References

 
 
© AVABIS GmbH privacypolicy about