CVE-2026-11974: WP Media Folder Addon SSRF Vulnerability

CVE-2026-11974 Overview

CVE-2026-11974 affects the wp-media-folder-addon WordPress plugin through version 4.1.6. The plugin fails to validate a user-supplied parameter before using it in a file read operation. Two AJAX actions expose this behavior to unauthenticated users, enabling Arbitrary File Disclosure and Server-Side Request Forgery (SSRF) on sites with a configured cloud storage connection. The flaw is classified under CWE-22 Path Traversal. This issue represents an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

Critical Impact
Unauthenticated attackers can read arbitrary files and issue server-side requests through vulnerable AJAX endpoints on sites with cloud storage configured.

Affected Products

WordPress wp-media-folder-addon plugin versions through 4.1.6
WordPress sites with a cloud storage connection configured in the addon
Sites previously patched only for CVE-2026-9690 remain exposed via the unpatched handlers

Discovery Timeline

2026-07-29 - CVE-2026-11974 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-11974

Vulnerability Analysis

The wp-media-folder-addon plugin exposes AJAX actions that accept a user-controlled parameter and pass it directly to a file read function. Because the endpoints do not verify authentication and do not sanitize the parameter, an unscoped remote request can trigger local file reads or outbound HTTP requests originating from the WordPress server.

Two distinct handlers are affected. The vendor previously addressed one handler in the fix for CVE-2026-9690, but the remaining handlers continued to invoke the same unsafe read primitive. As a result, the earlier patch did not eliminate the underlying weakness in the addon.

Successful exploitation yields two outcomes. First, arbitrary file disclosure allows retrieval of wp-config.php, private keys, and other sensitive files readable by the web server. Second, SSRF permits the attacker to reach internal services, cloud metadata endpoints, or lateral targets from the compromised host.

Root Cause

The root cause is missing input validation on a path or URL parameter consumed by cloud storage AJAX handlers. The handlers are registered for unauthenticated users through the wp_ajax_nopriv_ hook family, removing any access barrier before the file read executes.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP POST request to admin-ajax.php targeting the vulnerable AJAX action and supplies a local file path or internal URL. The plugin returns the file contents or the response from the internal resource. Exploitation only requires that the site administrator has configured a cloud storage connection in the addon.

Detection Methods for CVE-2026-11974

Indicators of Compromise

Unauthenticated POST requests to wp-admin/admin-ajax.php referencing cloud-storage AJAX actions provided by wp-media-folder-addon
AJAX request parameters containing path traversal sequences such as ../ or absolute paths like /etc/passwd and wp-config.php
Requests where the parameter value is an internal URL, file:// scheme, or cloud metadata endpoint such as 169.254.169.254
Web server responses returning large payloads or non-media content from AJAX endpoints

Detection Strategies

Inspect access logs for admin-ajax.php calls that reference the addon's cloud-storage actions from unauthenticated sessions
Alert on outbound connections from the WordPress host to link-local, RFC1918, or metadata service ranges immediately after inbound AJAX activity
Match request bodies against regular expressions for traversal patterns and non-HTTP schemes in parameters that should contain object identifiers

Monitoring Recommendations

Enable WordPress plugin auditing to confirm the installed version of wp-media-folder-addon across all sites
Forward web server and WordPress logs to a centralized store and correlate inbound AJAX activity with outbound network egress
Monitor file access patterns on wp-config.php and other sensitive files under the WordPress document root

How to Mitigate CVE-2026-11974

Immediate Actions Required

Update wp-media-folder-addon to a version later than 4.1.6 that addresses all affected cloud-storage handlers
If no fixed version is available, disable the addon on sites where a cloud storage connection is configured
Rotate cloud storage credentials and any secrets stored in files readable by the web server if exploitation is suspected
Restrict outbound network access from the WordPress host to only required cloud storage endpoints

Patch Information

Refer to the WPScan Vulnerability Report for advisory details. Because CVE-2026-11974 is an incomplete fix of CVE-2026-9690, verify that any applied patch covers every affected AJAX handler, not just the one addressed previously.

Workarounds

Block unauthenticated access to admin-ajax.php actions belonging to the addon at the web application firewall (WAF) layer
Add WAF rules that reject requests containing path traversal sequences or non-HTTPS URL schemes in AJAX parameters
Remove the cloud storage connection configuration to reduce the exploitable surface until a full patch is applied
Enforce network egress filtering that denies access to cloud metadata services and internal management interfaces from the web tier

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1029011974,\
   msg:'Block wp-media-folder-addon path traversal / SSRF attempt'"
  SecRule ARGS "@rx (\.\./|file://|https?://(127\.|10\.|169\.254\.|192\.168\.))" \
    "t:none,t:urlDecodeUni"