What is CVE-2026-80494?

CVE-2026-80494 is a high-severity vulnerability in Yogeta Wp Cloud, classified under Files or Directories Accessible to External Parties. CVSS score: 8.6/10. Published 2026-09-12.

How severe is CVE-2026-80494?

High severity. CVSS v3 base score is 8.6 out of 10.

Vulnerability in Yogeta Wp Cloud

CVE-2026-80494

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Unknown Yogeta Wp Cloud

Weakness classification (CWE)

CWE-552 — Files or Directories Accessible to External Parties

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-80494?: CVE-2026-80494 is a high-severity vulnerability in Yogeta Wp Cloud, classified under Files or Directories Accessible to External Parties. CVSS score: 8.6/10. Published 2026-09-12.
How severe is CVE-2026-80494?: High severity. CVSS v3 base score is 8.6 out of 10.