CyberRota Analysis
AI-GeneratedThe wp-media-folder-addon plugin for WordPress versions up to 4.1.6 is vulnerable to arbitrary file disclosure and server-side request forgery due to insufficient validation of user-supplied parameters in AJAX actions accessible to unauthenticated users. This vulnerability poses a significant risk, especially for sites configured with cloud storage connections, as it could lead to unauthorized access to sensitive files. WordPress site administrators using this plugin should prioritize immediate patching or removal to mitigate potential exploitation.
Original NVD Description
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.