PT-2026-50363 · WordPress · Wp Media Folder Addon

0Xd4Rk5Id3 · CVE-2026-9690 · Published 2026-06-17 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Media folder Addon versions 4.0.1 and earlier

Description An unauthenticated arbitrary file download issue exists, allowing an attacker to download files from the server without providing credentials.

Recommendations Update WP Media folder Addon to a version later than 4.0.1.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-9690

Affected Products

Wp Media Folder Addon

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9690 · Security Note
• https://patchstack.com/database/wordpress/plugin/wp-media-folder-addon/vulnerability/wordpress-wp-media-folder-addon-plugin-4-0-1-arbitrary-file-download-vulnerability?_s_id=cve · Note
• https://twitter.com/atomicedgeWAF/status/2068563638214852716 · Twitter Post
• https://t.me/cveNotify/226755 · Telegram Post