WordPress Plugin Vulnerabilities

Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Description

The plugin does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.

Proof of Concept

Affects Plugins

Plugin icon
mine-cloudvod
Fixed in 2.6.6

References

CVE
CVE-2026-124653

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Hariom Singh
Submitter
Hariom Singh
Verified
Yes
WPVDB ID
c476458c-215d-4056-bd82-06e59f0f84d4

Timeline

Publicly Published
2026-11-10 (about 2 days ago)
Added
2026-11-10 (about 1 day ago)
Last Updated
2026-11-10 (about 1 day ago)

Other

Published
Title
Published
2024-03-26
Title
WholesaleX < 1.3.2 - Sensitive Information Exposure via export_users
Published
2026-04-27
Title
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! < 3.6.2 - Authenticated (Contributor+) Information Exposure
Published
2025-08-11
Title
WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure
Published
2025-02-11
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.0.6 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2026-11-11
Title
Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure