PT-2026-145715
CVE-2026-124653
·
Published
2026-11-12
·
Updated
2026-11-12
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾