The vulnerability identified as CVE-2026-9690 in the Joomunited WP Media folder Addon (versions <=4.0.1) is a path traversal issue (CWE-22) that enables unauthenticated attackers to download arbitrary files from the server. The flaw arises from insufficient validation of file path inputs, allowing traversal outside intended directories. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows an unauthenticated attacker to download arbitrary files from the affected server, potentially exposing sensitive information. The confidentiality of data is compromised, but there is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor vendor communications for updates regarding patches or official mitigations.