{"id":"CVE-2026-118075","kind":"vulnerability","aliases":["CVE-2026-118075"],"related":[],"title":"WordPress WP Media folders plugin: contributors can inject PHP objects","description":"Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.","summary":"The WP Media folders WordPress plugin, versions 1.1.10 and earlier, has a PHP object injection flaw reachable by contributor-level users. Object injection can let an attacker run code or change application logic on the site, but the sources do not give the exact gadget chain or impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-media-folders","fixed":[],"affected":"<= 1.1.10","ecosystem":"wordpress"}],"ecosystems":[],"tags":["abandoned-plugin","package","php","wordpress","wp-media-folders"],"not_affected_if":["newer-version","no-contributor-accounts","plugin-not-installed"],"how_to_check":"In WP admin > Plugins, look for 'WP Media folders' (slug wp-media-folders) at version 1.1.10 or earlier; every released version is affected. Check for Contributor or higher accounts: Users > filter by role.","fix":"No fixed version. The plugin (latest 1.1.10, last updated 2021) was closed on WordPress.org on 2026-09-21 and is no longer downloadable. Remove or deactivate it, and use JoomUnited's WP Media Folder plugin instead (its features were merged there).","status":"open","published_at":"2026-10-29T16:18:02+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:28:05+00:00","updated_at":"2026-10-29T16:39:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:28:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WP Media folders plugin: contributors can inject PHP objects","impact":"high","summary":"The WP Media folders WordPress plugin, versions 1.1.10 and earlier, has a PHP object injection flaw reachable by contributor-level users. Object injection can let an attacker run code or change application logic on the site, but the sources do not give the exact gadget chain or impact.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-media-folders","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated contributor may trigger PHP object injection on site","analyst_note":"Find the fixed version and the vulnerable code path at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-118075 and the plugin's changelog.","how_to_check":"- Check the installed version of the WP Media folders plugin in the WordPress admin under Plugins; the sources say versions up to and including `1.1.10` are affected.\n- Confirm whether any users hold the Contributor role or higher on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version","no-contributor-accounts"],"who_is_affected":"Sites running the WP Media folders WordPress plugin at version 1.1.10 or earlier. The attacker needs a Contributor-level account on the site, so exposure depends on who can log in as a contributor. The sources do not describe the data path or configuration needed beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4048,"output_tokens":593,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable code path at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-118075 and the plugin's changelog.","search":"'-118075':13A,16A '-2026':12A,15A '1.1.10':38B,88C 'abandon':22B 'abandoned-plugin':21B 'applic':63B 'attack':58B 'chain':77B 'chang':62B 'code':60B 'contributor':6A,50B,80C 'contributor-level':49B 'cve':11A,14A 'earlier':40B 'exact':75B 'flaw':46B 'folder':4A,30B,34B,87C 'folders':20A 'gadget':76B 'give':73B 'impact':79B 'inject':8A,45B,54B,83C 'let':56B 'level':51B 'logic':64B 'media':3A,19A,29B,33B,86C 'object':10A,44B,53B,82C 'packag':24B 'php':9A,25B,43B,81C 'plugin':5A,23B,36B 'reachabl':47B 'run':59B 'site':67B 'sourc':70B 'user':52B 'version':37B,89C 'wordpress':1A,26B,35B 'wp':2A,18A,28B,32B,85C 'wp-media-fold':27B 'wp-media-folders':17A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the WP Media folders plugin (slug wp-media-folders, up to and including 1.1.10, the last release) installed. An attacker needs a Contributor-or-higher account to send serialized data that the plugin unserializes. Sites without the plugin, or that never give out Contributor accounts, can skip it. Note this is a different plugin from JoomUnited's WP Media Folder.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:39:23Z","by":"analyst","doc":"https://www.cve.org/CVERecord?id=CVE-2026-118075","run_id":1080},"products":{"at":"2026-10-29T16:39:23Z","by":"analyst","doc":"https://www.cve.org/CVERecord?id=CVE-2026-118075","run_id":1080}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118075","severity":null,"published_at":"2026-10-29T16:18:02+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118075:1080","url":null,"severity":null,"published_at":"2026-10-29T16:39:23+00:00","modified_at":"2026-10-29T16:39:23+00:00","first_seen_at":"2026-10-29T16:39:23+00:00","fetched_at":"2026-10-29T16:39:23+00:00","note":"CVE record by Patchstack, only the one-line description is available (NVD page empty). No gadget chain or PoC found. Plugin is abandoned and closed on wordpress.org 2026-09-21, so no fix exists; fix_status none based on that page. Not exploited as far as I found. Nothing to confuse it with CVE-2026-11974 or CVE-2026-9690, which are the separate wp-media-folder-addon plugin."}],"documents":[{"id":17843,"url":"https://wordpress.org/plugins/wp-media-folders/","title":"WP Media folders – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin closed as of September 21, 2026, not available for download; closure temporary pending full review. Latest version 1.1.10, last updated Sep 6 2021.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17845,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118075","title":"CVE Record CVE-2026-118075 (CNA: Patchstack)","kind":"advisory","source":"analyst","publisher":null,"text":"CNA: Patchstack. Contributor PHP Object Injection in WP Media folders <= 1.1.10.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}