WordPress Media folder Addon Unauth Arbitrary File Download (CVE-2026-11974)

Vulnerability Overview Vulnerability Name: Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Download Description: The plugin fails to validate user-supplied parameters before performing file read operations, allowing unauthenticated users to exploit two AJAX endpoints to trigger arbitrary file disclosure and Server-Side Request Forgery (SSRF). This vulnerability is an incomplete fix for CVE-2026-9690, as it only addresses some affected cloud storage handlers, leaving others unfixed. CVE ID: CVE-2026-11974 Classification: - Type: TRAVERSAL - OWASP Top 10: A1: Injection - CWE: CWE-22 - CVSS: 8.6 (High) Affected Range Affected Plugin: wp-media-folder-addon Known Fixes: No known fixes Remediation PoC Code: The PoC will be published on August 8, 2026, to give users time to update. Timeline Public Release Date: 2026-07-08 Added Date: 2026-07-08 Last Updated: 2026-07-28 Additional Information Original Researcher: Erwan LR (WPScan) Submitter: Erwan LR (WPScan) Submitter Website: https://wpscan.com Verification Status: Yes WPVDB ID: 7b6aea5d-2e2e-4920-9776-b15841ba1f26 Related Vulnerabilities Ultimate Member < 2.5.1 - Admin+ LFI via Traversal (2022-10-28) WordPress Download Manager < 3.1.25 - Authenticated Directory Traversal (2021-07-29) Contact Form by WPForms < 1.7.5.5 - Admin+ Arbitrary File Access (2022-09-19) All-In-One WP Migration < 7.59 - Admin+ File Deletion on Windows Hosts via Path Traversal (2022-04-28) Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal (2025-03-11) Summary This vulnerability involves an unauthenticated arbitrary file download issue in the Media folder Addon plugin, affecting versions up to and including 4.1.6. There are currently no known fixes available, and the PoC will be published on August 8, 2026. Users are advised to monitor for subsequent updates and apply patches promptly.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Media folder Addon Unauth Arbitrary File Download (CVE-2026-11974)