Atomic Edge analysis of CVE-2026-9690 (metadata-based): This vulnerability allows unauthenticated attackers to download arbitrary files from the WordPress server through the Media folder Addon plugin. The plugin versions up to and including 4.0.1 are affected. The CVSS score is 9.1, indicating critical severity.
The root cause is a Path Traversal vulnerability (CWE-22). The plugin likely fails to properly sanitize user-supplied input used in file read operations. The attacker can inject directory traversal sequences such as ‘../’ to escape the intended directory. Based on the CWE classification and description, this vulnerability most likely exists in a file download handler that reads files based on a user-controlled parameter without validating the resolved path remains within an allowed directory. No code diff is available for confirmation.
Exploitation targets an AJAX handler or REST endpoint that serves file downloads. The plugin slug ‘wp-media-folder-addon’ suggests an endpoint like /wp-admin/admin-ajax.php with action parameter ‘media_folder_download’ or similar. The attacker sends a request with a parameter containing path traversal sequences, e.g., file=../../../wp-config.php. Since no authentication is required, any unauthenticated user can exploit this to read sensitive files.
The remediation requires adding proper path validation. The fix in version 4.0.2 likely implements realpath() or similar to canonicalize the file path and then verifies it starts with the allowed base directory. Input validation should also strip or reject path traversal sequences before the path is used.
The impact is high. Attackers can read the wp-config.php file containing database credentials, encryption keys, and other secrets. This can lead to full site compromise, data breaches, and potentially lateral movement if database credentials are reused elsewhere.
