The wp‑media‑folder‑addon for WordPress before version 4.1.7 fails to validate a user‑supplied parameter used in a file read operation within two unauthenticated AJAX actions, resulting in arbitrary file disclosure and server‑side request forgery on sites with a configured cloud‑storage connection. The flaw remains after the incomplete fix of CVE‑2026‑9690, which hardened only one cloud‑storage handler. Attackers can therefore retrieve arbitrary server files or direct requests to internal hosts, mapping to CWE‑22.

The affected product is the wp‑media‑folder‑addon WordPress plugin of any vendor. Any site running versions up to and including 4.1.6 is vulnerable. The plugin is part of WordPress sites that have enabled the media folder functionality, especially those configured to use cloud‑storage services. The vulnerability is tied to the plugin’s AJAX endpoints without any authentication requirement.

With a CVSS score of 8.6 the flaw is considered high severity. The EPSS score is below 1 %, indicating a low but non‑zero exploitation probability at the time of this assessment. The vulnerability is not included in the CISA KEV catalogue. The likely attack vector is an unauthenticated web request to the exposed AJAX endpoint, where the attacker supplies a crafted file path or URL to trigger the file read. Successful exploitation gives the attacker access to arbitrary server files, or to internal resources via server‑side request forgery. No special privileges or network connectivity beyond access to the site are required.