8.8High

CVE-2026-118075WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

dbarrere WP Media folders Published: 2026-10-29 18:24 (4 days ago)

Description

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

Weakness (CWE): CWE-502

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
dbarrere	WP Media folders	≤ 1.1.10

References and patches

https://patchstack.com/database/wordpress/plugin/wp-media-folders/vulnerability/wordpress-wp-media-folders-pl… vdb-entry

CVSS score

8.8High

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All scores (2)

cna	CVSS 3.1	8.8High
audit@patchstack.com	CVSS 3.1	8.8High

EPSS (chance of exploitation in 30 days)

0.37%

higher than 31% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2026-10-27
Published2026-10-29 18:24
Reached IP-DB2026-10-29 19:03
Last updated2026-10-29 21:17

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

9.8Critical

CVE-2026-86596 1 hour ago

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…

9.8Critical

CVE-2026-102435 3 hours ago

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

themefic Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated att…

5.3Medium

CVE-2026-103310 15 hours ago

PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

PayHere Payment Gateway

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…

6.5Medium

CVE-2026-119480 yesterday

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Crocoblock JetFormBuilder

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

7.1High

CVE-2026-66570 yesterday

WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Nickboss WordPress File Upload

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.

9.3Critical

CVE-2026-62048 yesterday

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Liquid Web / StellarWP BookIt

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.