CVE-2026-9690 is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability in the WP Media folder Addon by Joomunited. The flaw allows unauthenticated attackers to exploit a path traversal weakness to download arbitrary files from the server. The affected versions include all versions up to and including 4.0.1. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated attacker to download arbitrary files from the server hosting the vulnerable WP Media folder Addon. This can lead to disclosure of sensitive information, potentially including configuration files, credentials, or other private data. There is no impact on system integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if possible. Monitor vendor communications for updates on patches or mitigations.