CVE-2026-9690: WP Media Folder Path Traversal Flaw

CVE-2026-9690 Overview

CVE-2026-9690 is an unauthenticated arbitrary file download vulnerability in the WP Media folder Addon WordPress plugin versions 4.0.1 and earlier. The flaw maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. Remote attackers can retrieve arbitrary files from the WordPress host without authentication or user interaction.

Successful exploitation discloses sensitive server-side files, including wp-config.php, which contains database credentials and secret keys. The issue is network-reachable and trivial to weaponize against exposed WordPress sites.

Critical Impact
Unauthenticated remote attackers can download arbitrary files from vulnerable WordPress installations, exposing credentials, configuration data, and source code.

Affected Products

WP Media folder Addon plugin for WordPress, versions <= 4.0.1
WordPress sites with the vulnerable plugin installed and active
Any hosting environment exposing the plugin endpoint to the network

Discovery Timeline

2026-06-17 - CVE-2026-9690 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-9690

Vulnerability Analysis

The vulnerability is a path traversal flaw classified under [CWE-22]. The WP Media folder Addon plugin exposes a file download function that fails to validate or sanitize user-supplied path input. An attacker supplies a crafted file path containing directory traversal sequences such as ../ to escape the intended media directory.

Because the endpoint does not enforce authentication, any remote user can issue the request. The server reads the targeted file from disk and returns its contents in the HTTP response. Attackers commonly target wp-config.php, .htaccess, backup archives, and log files containing session data.

The vulnerability affects only confidentiality. It does not modify files or disrupt service directly. However, leaked database credentials and authentication secrets enable follow-on attacks, including database compromise and administrative session forgery.

Root Cause

The root cause is missing input validation on the file path parameter consumed by the plugin's download handler. The handler concatenates attacker-controlled input into a filesystem path without canonicalization or allow-list enforcement. PHP file read primitives then operate on paths outside the intended media directory.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. The attacker sends a single crafted request to the vulnerable plugin endpoint with a traversal payload in the file parameter. No credentials, tokens, or user interaction are required. See the Patchstack Vulnerability Analysis for additional technical context.

No public proof-of-concept exploit code has been published, and the EPSS data does not indicate active exploitation at this time.

Detection Methods for CVE-2026-9690

Indicators of Compromise

HTTP requests to WP Media folder Addon endpoints containing traversal sequences such as ../, ..%2f, or URL-encoded variants
Web server access logs showing unauthenticated requests for wp-config.php, /etc/passwd, or other sensitive files via plugin parameters
Outbound responses from the WordPress host containing large file payloads tied to plugin download handlers
Subsequent unexpected administrative logins or database access following file disclosure events

Detection Strategies

Inspect WordPress access logs for requests targeting the wp-media-folder-addon path with file or path query parameters
Deploy web application firewall (WAF) rules that block directory traversal patterns in plugin parameters
Alert on anomalous file read patterns from the PHP worker process, particularly reads of wp-config.php from non-admin contexts
Correlate plugin endpoint access with downstream credential reuse against the WordPress database

Monitoring Recommendations

Enable verbose HTTP logging on WordPress reverse proxies and retain logs for forensic review
Monitor file integrity for wp-config.php and other sensitive WordPress configuration files
Track plugin version inventory across WordPress sites to identify exposure to WP Media folder Addon <= 4.0.1
Alert on first-seen IP addresses issuing requests to plugin download endpoints

How to Mitigate CVE-2026-9690

Immediate Actions Required

Identify all WordPress sites running WP Media folder Addon and confirm installed versions
Update the plugin to a fixed release above 4.0.1 once published by the vendor
Rotate database credentials, WordPress salts, and API keys if wp-config.php may have been exposed
Audit administrative accounts and active sessions for unauthorized access

Patch Information

Review the Patchstack Vulnerability Analysis for current patch availability and vendor advisories. Apply the fixed plugin version through the WordPress admin dashboard or via WP-CLI as soon as the vendor releases an update addressing CVE-2026-9690.

Workarounds

Deactivate and remove the WP Media folder Addon plugin until a patched version is installed
Deploy WAF rules that block path traversal sequences such as ../ and ..%2f in HTTP requests to the plugin
Restrict access to the plugin endpoint by IP allow-list at the reverse proxy or web server layer
Set restrictive filesystem permissions on wp-config.php and other sensitive files to limit the PHP worker's read scope where feasible

bash

# Example nginx rule blocking traversal patterns on the plugin endpoint
location ~* /wp-content/plugins/wp-media-folder-addon/ {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e%2f)") {
        return 403;
    }
}