CVE-2026-124653— Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
Quick assessment
Affected
Unknown Mine CloudVod
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 2.6.6 版本之前，Mine CloudVod WordPress 插件未对多个 REST API 路由中请求云存储上传凭证的用户进行限制，导致未经身份验证的攻击者能够获取站点所配置的阿里云 OSS、腾讯云 COS 以及 Dogecloud 账户的签名上传策略和临时凭证，并利用这些凭证在站点的存储中上传或覆盖文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-124653
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Mine CloudVod | 0 ~ 2.6.6 | - |
|
II. Public POCs for CVE-2026-124653
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-124653
请登录查看更多情报信息。
Other References for CVE-2026-124653 (1)
-
https://wpscan.com/vulnerability/c476458c-215d-4056-bd82-06e59f0f84d4/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total
| CVE-2026-122003 | Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF | |
| CVE-2026-110072 | Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr | |
| CVE-2026-110041 | Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E | |
| CVE-2026-106027 | Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v | |
| CVE-2026-110959 | Descope < 1.2.0 - Unauthenticated Account Takeover | |
| CVE-2026-119039 | Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti | |
| CVE-2026-118421 | WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter | |
| CVE-2026-118531 | Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update | |
| CVE-2026-123044 | ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure | |
| CVE-2026-119040 | Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification | |
| CVE-2026-76792 | User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L | |
| CVE-2026-121498 | Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR | |
| CVE-2026-123092 | WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio | |
| CVE-2026-124652 | Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR | |
| CVE-2026-124647 | TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie | |
| CVE-2026-124648 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key | |
| CVE-2026-124815 | Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions | |
| CVE-2026-124814 | Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't | |
| CVE-2026-124817 | Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification | |
| CVE-2026-124665 | Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account -
CVE-2026-124665
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales -
CVE-2026-124817
Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modi -
CVE-2026-124814
Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticate -
CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record D