CVE-2026-124653
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.