CVE-2026-124653mediumCWE-200

CVE-2026-124653: medium-severity vulnerability in Mine CloudVod

Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Published

Follow this CVE+ Monitor Mine CloudVod

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.5epss 0.1%
The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Mine CloudVod
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Mine CloudVod

In the same product, most dangerous first.

CVE-2026-124652MEDIUMMine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOREPSS 0.1%CVE-2026-124664MEDIUMMine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content DisclosureEPSS —