CVE-2026-124653: Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Q: Who can exploit this issue?

Any unauthenticated remote attacker able to reach the affected WordPress site's REST API routes can request the cloud storage upload credentials. No WordPress account or prior authorization is required.

Q: Which cloud storage configurations are exposed?

Sites configured to use Alibaba Cloud OSS, Tencent Cloud COS, or Dogecloud through the plugin may expose signed upload policies and temporary credentials. The disclosed credentials can be used against the site's configured storage account.

Q: What can an attacker do with the disclosed credentials?

An attacker can use the signed upload policies and temporary credentials to upload files to, or overwrite files in, the site's cloud storage.

Q: Are patched installations affected?

The issue affects Mine CloudVod versions before 2.6.6. Version 2.6.6 is not described as affected.

Published Nov 12, 2026

Updated

The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mine CloudVod WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.6.6

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker able to reach the affected WordPress site's REST API routes can request the cloud storage upload credentials. No WordPress account or prior authorization is required.

Which cloud storage configurations are exposed?

Sites configured to use Alibaba Cloud OSS, Tencent Cloud COS, or Dogecloud through the plugin may expose signed upload policies and temporary credentials. The disclosed credentials can be used against the site's configured storage account.

What can an attacker do with the disclosed credentials?

An attacker can use the signed upload policies and temporary credentials to upload files to, or overwrite files in, the site's cloud storage.

Are patched installations affected?

The issue affects Mine CloudVod versions before 2.6.6. Version 2.6.6 is not described as affected.

CVE-2026-124653: Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which cloud storage configurations are exposed?

What can an attacker do with the disclosed credentials?

Are patched installations affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which cloud storage configurations are exposed?

What can an attacker do with the disclosed credentials?

Are patched installations affected?