CVE-2026-80494: Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the affected plugin’s public endpoint may be able to exploit it. No WordPress account or authorization is required.
What does an attacker need to provide?
The attacker needs to supply a file path to the vulnerable public endpoint. The plugin does not validate that path before using it in a file-read function.
What could be exposed if exploitation succeeds?
An attacker may download arbitrary files accessible to the server process, including files containing sensitive credentials.
Are installations running version 1.0 affected?
Yes. The affected versions are through 1.0, which includes version 1.0.