REST API Vulnerability in Mine CloudVod Plugin for WordPress
CVE-2026-124653
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 November 2026
Badges
What is CVE-2026-124653?
The Mine CloudVod plugin for WordPress prior to version 2.6.6 has a significant security flaw that lacks proper authentication measures. This vulnerability allows unauthenticated attackers to access REST API routes that are intended to request cloud storage upload credentials. As a result, malicious actors can acquire signed upload policies and temporary credentials for various cloud services like Alibaba Cloud OSS, Tencent Cloud COS, and Dogecloud. This oversight permits these attackers to upload or overwrite files within the site's storage, potentially leading to data breaches or unauthorized alterations. It is crucial for users of the affected plugin to update to the latest version to mitigate this risk.
Affected Version(s)
Mine CloudVod 0 < 2.6.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.