CVE-2026-80494: Yogeta WP Cloud Path Traversal Vulnerability

CVE-2026-80494 Overview

CVE-2026-80494 affects the Yogeta WP Cloud WordPress plugin through version 1.0. The plugin exposes a public endpoint that accepts a user-supplied file path and passes it to a file-read function without validation or authorization checks. Unauthenticated attackers can request arbitrary files from the server, including configuration files that contain database credentials, API keys, and other secrets. The issue is categorized under [CWE-552] (Files or Directories Accessible to External Parties).

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the WordPress host, exposing wp-config.php credentials and enabling follow-on compromise of the site and its database.

Affected Products

Yogeta WP Cloud WordPress plugin, versions up to and including 1.0
WordPress installations with the plugin activated
Any hosting environment where the plugin serves the vulnerable public endpoint

Discovery Timeline

2026-09-12 - CVE-2026-80494 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80494

Vulnerability Analysis

The Yogeta WP Cloud plugin registers a public HTTP endpoint that accepts a file path parameter from the request. The handler passes this parameter directly to a file-read function and returns the file contents in the response. Two defects combine to produce the exposure. First, the endpoint performs no capability or nonce check, so any unauthenticated visitor can reach it. Second, the file path parameter is not validated against an allow-list or normalized to reject traversal sequences such as ../.

An attacker who reads wp-config.php obtains WordPress database credentials, the authentication and nonce salts, and the table prefix. Those values enable database compromise and forgery of session cookies. The vulnerability affects confidentiality only; the flaw does not modify data or terminate the WordPress process.

Root Cause

The root cause is missing authorization combined with missing input validation on a file-read code path. [CWE-552] describes the class of defect: a resource intended to be internal is made reachable to external parties. The plugin trusts a request parameter to designate a safe file location, but WordPress plugins run with the web server's file system privileges and can read anything the PHP process can read.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends a single HTTP request to the vulnerable endpoint with a crafted path parameter that traverses to a target file. No authentication, user interaction, or prior foothold is required. The scope change reflected in the metrics indicates that a successful read can expose data owned by components beyond the plugin itself, such as the WordPress core configuration and adjacent application files. Refer to the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-80494

Indicators of Compromise

HTTP requests to Yogeta WP Cloud plugin endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes in a file or path parameter.
Access log entries showing unauthenticated reads that reference wp-config.php, /etc/passwd, .env, or private key files.
Outbound authentication or database activity originating from IP addresses that previously issued file-read requests to the plugin.

Detection Strategies

Inspect web server access logs for requests to plugin routes under /wp-content/plugins/ associated with Yogeta WP Cloud and flag any request whose query string contains traversal patterns.
Deploy a web application firewall rule that blocks unauthenticated requests to the plugin endpoint when the file path parameter references sensitive filenames or contains directory traversal tokens.
Correlate file-read requests with subsequent administrative logins or wp-admin activity to detect credential reuse following disclosure.

Monitoring Recommendations

Alert on any successful HTTP 200 response returning content types inconsistent with the plugin's normal output, such as text/plain responses containing PHP source or environment variable syntax.
Monitor WordPress file integrity for changes to wp-config.php and salt values, and rotate credentials if disclosure is suspected.
Track database connections from unexpected source addresses using the credentials stored in wp-config.php.

How to Mitigate CVE-2026-80494

Immediate Actions Required

Deactivate and remove the Yogeta WP Cloud plugin from all WordPress installations until a patched release is verified.
Rotate all secrets stored in wp-config.php, including database passwords and the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values and their salts.
Review web server access logs for prior exploitation attempts and treat any successful reads of configuration files as a confirmed disclosure.

Patch Information

No vendor patch is referenced in the current advisory. The vulnerability affects the plugin through version 1.0. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a fixed version, and apply it as soon as it is published.

Workarounds

Block requests to the vulnerable plugin endpoint at the web server or WAF layer until a patched release is available.
Restrict read permissions on wp-config.php and other sensitive files to the minimum required for the PHP process, and store secrets outside the web root where practical.
Enable PHP open_basedir restrictions to constrain the directories the WordPress process can read.

bash

# Example nginx location block to deny access to the vulnerable plugin path
location ~* /wp-content/plugins/yogeta-wp-cloud/ {
    deny all;
    return 403;
}