CVE-2026-80494

The Yogeta WP Cloud WordPress plugin through version 1.0 fails to validate a user-supplied file path before passing it to a file-read function on a public endpoint that has no authorization check. This allows an unauthenticated remote attacker to craft a request referencing an arbitrary path and download any file readable by the web server, including files containing sensitive credentials such as wp-config.php. Successful exploitation can expose database credentials, salts, and secrets, effectively enabling full site compromise. Any site running the plugin at version 1.0 or earlier is affected. The flaw is not in CISA's KEV, and no public PoC or observed exploitation is known at this time.

What to do: No patched version is indicated in the data, so the safest action is to deactivate and remove the Yogeta WP Cloud plugin until a fix is released; if removal is not immediately possible, block external access to its public endpoint using WAF or firewall rules. Because credential files such as wp-config.php are readable, rotate database passwords, salts, and any API keys stored on the server. Review web and access logs for unauthenticated file-download requests targeting the plugin's endpoint.