# CVE-2026-11974: JoomUnited wp-media-folder-addon Arbitrary File Disclosure and SSRF

Source: https://junglewise.ai/threats/cve-2026-11974-joomunited-wp-media-folder-addon-arbitrary-file-disclosure-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-11974 · Severity: info · CVSS 8.6 · Published 2026-07-29

The wp-media-folder-addon plugin for WordPress, which extends media management capabilities with cloud storage integration, contains a security flaw that allows unauthorized users to access sensitive files. By exploiting this vulnerability, an attacker can read internal system files or perform unauthorized requests to other internal services, potentially leading to data theft or further network compromise. This issue exists because a previous security fix was incomplete, leaving several cloud storage handlers unprotected.

Vendors: [JoomUnited](https://junglewise.ai/threats/vendors/joomunited).

## Quick answers

**Is CVE-2026-11974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11974 being exploited in the wild.

**How severe is CVE-2026-11974?** Informational severity, with a CVSS score of 8.6, published 29 July 2026.

**Which products and versions are affected?** JoomUnited wp-media-folder-addon <= 4.1.6.

**Is there a fix for CVE-2026-11974?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11974 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11974?** Check whether you run JoomUnited WP Media Folder Addon. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wp-media-folder-addon plugin fails to validate user-supplied parameters before using them in file read operations within two specific AJAX actions. This vulnerability is accessible to unauthenticated remote attackers and can lead to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF), particularly on installations where cloud storage connections (such as Google Drive or Dropbox) are configured. This vulnerability stems from an incomplete fix for a previous issue (CVE-2026-9690), where only one cloud-storage handler was hardened while others remained vulnerable. As of the advisory date, no known fix has been released for version 4.1.6.

## Affected products

- JoomUnited wp-media-folder-addon <= 4.1.6

## Timeline

- 2026-07-08: disclosed: Initial public disclosure by WPScan
- 2026-07-29: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26/](https://wpscan.com/vulnerability/7b6aea5d-2e2e-4920-9776-b15841ba1f26/)

## Related threats

- [Joomunited WP Media folder Addon path traversal arbitrary file download](https://junglewise.ai/threats/cve-2026-9690-joomunited-wp-media-folder-addon-path-traversal-arbitrary-file)