Quick answers
- Is CVE-2026-11974 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11974 being exploited in the wild.
- How severe is CVE-2026-11974?
- Informational severity, with a CVSS score of 8.6, published 29 July 2026.
- Which products and versions are affected?
- JoomUnited wp-media-folder-addon <= 4.1.6.
- Is there a fix for CVE-2026-11974?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-11974 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-11974?
- Check whether you run JoomUnited WP Media Folder Addon. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The wp-media-folder-addon plugin fails to validate user-supplied parameters before using them in file read operations within two specific AJAX actions. This vulnerability is accessible to unauthenticated remote attackers and can lead to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF), particularly on installations where cloud storage connections (such as Google Drive or Dropbox) are configured. This vulnerability stems from an incomplete fix for a previous issue (CVE-2026-9690), where only one cloud-storage handler was hardened while others remained vulnerable. As of the advisory date, no known fix has been released for version 4.1.6.
Affected products
- JoomUnited wp-media-folder-addon <= 4.1.6
Timeline
- 2026-07-08: disclosed: Initial public disclosure by WPScan
- 2026-07-29: advisory: NVD publication date