What the vulnerability does
01Description
The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub_dir' and 'media_items' parameters. This is due to insufficient validation of user-supplied file paths, which are not checked for directory traversal sequences or restricted to the intended uploads directory. This makes it possible for authenticated attackers, with Author-level access and above, to perform actions on files outside of the originally intended directory.
Explanation of Vulnerability in Simple Terms
02Summary
Media Sync versions 1.4.9 and earlier contain a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with low-level access can bypass directory restrictions and access sensitive files outside the intended application directory. No user interaction is required to exploit this flaw.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including configuration files and other sensitive data.
Potential impact on your site
04Site Impact
Sensitive files (config, database credentials, private keys) may be exposed to authenticated attackers.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account or login credentials for the application.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
