WP Media folders WordPress plugin: PHP Object Injection by Contributor users
Summary
The WordPress plugin WP Media folders up to and including version 1.1.10 is vulnerable to PHP Object Injection. An authenticated user with the Contributor role can submit crafted serialized data, which the plugin processes unsafely, so an attacker may be able to manipulate application logic and cause harmful actions on the server. The plugin is discontinued, and no official patch is known.
Affected
- WP Media folders plugin (dbarrere) up to and including 1.1.10
- Required privilege: Contributor account
Fixed in
- Unknown. No patched release or vendor advisory found.
Workaround
- Deactivate and delete the plugin; migrate folder functionality to a maintained alternative after checking its security status.
- If removal is not possible short term: audit and remove unused or unknown Contributor accounts; restrict media upload rights; keep WordPress core, themes and other plugins current; monitor for unexpected file or database changes.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof-of-concept exploit found for this CVE or plugin.
- EPSS 0.37 % (percentile 31).
- Patchstack rates it as medium priority; VulDB scores it 6.3 (Medium), the CNA 8.8.
Our recommendation
- Inventory WordPress sites for this plugin and remove it where feasible; treat this as high-priority removal, since no patch is expected.
- Review and reduce Contributor accounts, especially unused or unknown ones.
- Monitor sites for unexpected file or database changes.
- Re-check the CVE status and any vendor statement regularly, as the disclosure is very recent.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB entry vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- Strix CVE record CVE-2026-118075 www.strix.ai
- WordPress.org support forum (discontinued notice) wordpress.org
- InstaWP plugin page (changelog) instawp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:06.
Original description (NVD)
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.