{"id":"CVE-2026-11974","aliases":["EUVD-2026-50114","GHSA-fj8r-hgww-qgmw"],"status":"published","title":"Media folder Addon \u003c 4.1.7 - Unauthenticated Arbitrary File Download","description":"The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00732,"percentile":0.54681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-07-29T06:00:02Z","modified":"2026-08-10T13:17:52Z","products":[{"vendor":"unknown","product":"wp-media-folder-addon"}],"references":[{"url":"https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11974"},{"url":"https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26"},{"url":"https://github.com/advisories/GHSA-fj8r-hgww-qgmw"}],"sources":{"cve":[{"id":"CVE-2026-11974","title":"Media folder Addon \u003c 4.1.7 - Unauthenticated Arbitrary File Download","description":"The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.","status":"published","published":"2026-07-29T06:00:02.103Z","modified":"2026-08-10T12:36:11.753Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:04.809935Z"}],"euvd":[{"id":"EUVD-2026-50114","description":"The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.","status":"published","published":"2026-07-29T06:00:02Z","modified":"2026-08-10T12:36:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-fj8r-hgww-qgmw","title":"The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied...","description":"The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.","status":"published","published":"2026-07-29T09:31:26Z","modified":"2026-07-29T15:32:15Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2026-11974","description":"The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.","status":"published","published":"2026-07-29T07:16:41.143Z","modified":"2026-08-10T13:17:52.66Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:33.629616Z"}]}}