Live › vulnerability › CVE-2026-118075
The WP Media folders WordPress plugin, versions 1.1.10 and earlier, has a PHP object injection flaw reachable by contributor-level users. Object injection can let an attacker run code or change application logic on the site, but the sources do not give the exact gadget chain or impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress sites with the WP Media folders plugin (slug wp-media-folders, up to and including 1.1.10, the last release) installed. An attacker needs a Contributor-or-higher account to send serialized data that the plugin unserializes. Sites without the plugin, or that never give out Contributor accounts, can skip it. Note this is a different plugin from JoomUnited's WP Media Folder.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wp-media-folders | wordpress | <= 1.1.10 | – |
WP Media folders (slug wp-media-folders) at version 1.1.10 or earlier; every released version is affected1.1.10, last updated 2021) was closed on WordPress.org on 2026-09-21 and is no longer downloadableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118075")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.