CVE-2026-9690: Unauthenticated File Download in WP Media Folder Addon – Vulnerability Explainer

Technical summary

CVE-2026-9690 is a path traversal vulnerability (CWE-22) in the WP Media folder Addon that permits unauthenticated file download operations. The plugin fails to implement proper authorization checks or input validation on file retrieval endpoints, allowing attackers to craft requests that bypass intended access restrictions. The CVSS v3.1 score of 7.5 (HIGH) reflects the network-exploitable nature, low attack complexity, and high confidentiality impact; integrity and availability are not compromised by the flaw itself.

Business impact

Organizations running vulnerable versions of WP Media folder Addon face immediate risk of unauthorized data exposure. Attackers can exfiltrate sensitive files—including WordPress configuration files containing database credentials, backup archives, theme or plugin source code, and user data—without detection or authentication. This exposure may lead to secondary compromise of database systems, credential theft, or pivot attacks into broader infrastructure. For agencies or enterprises using this plugin, the reputational and compliance costs of a data breach are substantial.

Affected systems

WP Media folder Addon versions 4.0.1 and earlier are vulnerable. The plugin is deployed on self-hosted WordPress installations that have enabled the addon. Websites running version 4.0.2 or later are not affected. The scope is limited to WordPress sites that have actively installed this specific plugin; WordPress.org-hosted sites using Jetpack or other managed services are not impacted.

Exploitability

The vulnerability is trivial to exploit. No authentication is required, no user interaction is needed, and an attacker requires only network access to the WordPress site. Exploitation requires crafting a simple HTTP request to the vulnerable endpoint with path traversal parameters. The attack is deterministic and repeatable. However, this vulnerability is not currently tracked in the CISA KEV catalog, indicating it has not yet been observed in active, coordinated attack campaigns at scale.

Remediation

Immediately update WP Media folder Addon to version 4.0.2 or later. If immediate patching is not feasible, consider disabling or removing the plugin until the update can be applied. Organizations should verify that no unauthorized file access has occurred by reviewing server access logs for suspicious download requests to the plugin's file-serving endpoints.

Patch guidance

Navigate to the WordPress admin dashboard, go to Plugins > Installed Plugins, locate WP Media folder Addon, and click Update if available. Alternatively, download version 4.0.2 or later from the official WordPress plugin repository and manually upload it. Verify the update was successful by checking the plugin version in the admin panel. After patching, review recent access logs to confirm no exploitation occurred during the vulnerable window.

Detection guidance

Monitor web server logs for unusual requests to the WP Media folder Addon's file download endpoints—typically paths containing file-serving functions or parameters (e.g., query strings with file path variables). Look for requests containing path traversal patterns such as '../' or encoded equivalents ('%2e%2e%2f'). Alert on any successful downloads (HTTP 200 responses) from unexpected file paths, especially those pointing to wp-config.php, .htaccess, or backup files. Correlate with failed authentication attempts or requests originating from unusual geographic locations. WAF rules should block requests with suspicious file path patterns targeting this plugin.

Why prioritize this

Although this vulnerability carries a HIGH CVSS score and requires no authentication to exploit, it is not yet in active exploitation as an attack vector tracked by CISA. Organizations should treat this as a near-term priority—patch within 1–2 weeks—rather than a critical emergency requiring same-day response. Prioritization should be elevated for organizations handling sensitive data, those subject to compliance frameworks (HIPAA, PCI-DSS, GDPR), or those running public-facing WordPress instances. Any organization that cannot immediately confirm they are not running WP Media folder Addon should audit their plugin inventory urgently.

Risk score, explained

The CVSS 7.5 rating reflects a high-severity confidentiality impact in a network-exploitable attack that requires no privileges or user interaction. The score would be higher (8.6 or above) if integrity or availability were compromised; it remains 7.5 because the vulnerability enables data exfiltration only. The absence of KEV status means this has not been weaponized in observed incident response data, reducing real-world urgency slightly, but the technical ease of exploitation means it could be weaponized rapidly if public exploits emerge.

Frequently asked questions