CVE-2026-11974

Name of the Vulnerable Software and Affected Versions wp-media-folder-addon versions prior to 4.1.7

Description Unauthenticated users can exploit a lack of validation of a user-supplied parameter used in file read operations within two AJAX actions. On sites with a configured cloud storage connection, this can lead to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF), which is a technique used to induce a server to make requests to an unintended location.

Recommendations Update wp-media-folder-addon to version 4.1.7 or later.