CVE-2026-118075

Name of the Vulnerable Software and Affected Versions WP Media folders versions prior to 1.1.11

Description Authenticated attackers with contributor-level access and above can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the presence of a POP chain in another installed plugin or theme could allow the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 1.1.10.