Path Traversal Vulnerability in Media Sync Plugin for WordPress

CVE-2026-6670

What is CVE-2026-6670?

The Media Sync plugin for WordPress is susceptible to a path traversal vulnerability due to improper validation of user input related to file paths. This flaw allows authenticated attackers with Author-level access or higher to manipulate file path parameters ('sub_dir' and 'media_items') to access files outside of the secure uploads directory. As a result, an attacker could potentially read or modify files stored on the server that should not be accessible, highlighting a significant security concern for sites utilizing this plugin.

References