Is CVE-2026-9690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9690 being exploited in the wild.

How severe is CVE-2026-9690?

High severity, with a CVSS score of 7.5, published 17 June 2026.

Which products and versions are affected?

JoomUnited WP Media Folder Addon <= 4.0.1.

Is there a fix for CVE-2026-9690?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9690 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9690?

Check whether you run JoomUnited WP Media Folder Addon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9690: Joomunited WP Media folder Addon path traversal arbitrary file download

Q: Is there a fix for CVE-2026-9690?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-9690 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-9690?

Check whether you run JoomUnited WP Media Folder Addon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9690 · Severity: high · CVSS 7.5 · Published 2026-06-17

A security vulnerability exists in the WP Media folder Addon, a WordPress plugin used for advanced media management. An unauthenticated attacker can download sensitive files from the web server, potentially exposing configuration files, database credentials, or site backups. This could lead to a full site takeover or the theft of customer data.

Vendors: JoomUnited.

Quick answers

Is CVE-2026-9690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9690 being exploited in the wild.
How severe is CVE-2026-9690?: High severity, with a CVSS score of 7.5, published 17 June 2026.
Which products and versions are affected?: JoomUnited WP Media Folder Addon <= 4.0.1.
Is there a fix for CVE-2026-9690?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9690 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9690?: Check whether you run JoomUnited WP Media Folder Addon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Joomunited WP Media folder Addon plugin for WordPress. The flaw allows an unauthenticated remote attacker to perform arbitrary file downloads by sending specially crafted requests to the server. Because the application fails to properly validate or sanitize user-supplied input used to identify files for download, an attacker can access files outside of the intended directory, such as wp-config.php. This vulnerability is resolved in version 4.0.2.

Affected products

Joomunited WP Media folder Addon <= 4.0.1

Timeline

2025-10-22: other: Vulnerability reported by researcher 0xd4rk5id3
2026-06-04: advisory: Patchstack published advisory and mitigation rules
2026-06-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.