CVE-2026-61980
Received Received - Intake

BaseFortify

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Patchstack

Description
Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-61980
EUVD
EUVD-2026-57977

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patchstack omgf_pro to 5.2.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61980 is an Unauthenticated Arbitrary File Download vulnerability in OMGF Pro plugin versions 5.2.7 and earlier. It allows unauthenticated attackers to download any file from the website without needing access credentials.

Detection Guidance

To detect this vulnerability, check if your OMGF Pro plugin version is 5.2.7 or earlier. You can do this by logging into your WordPress admin panel, navigating to Plugins, and looking for OMGF Pro. If the version is 5.2.7 or below, the site is vulnerable. Alternatively, use the command 'wp plugin list' in the WordPress directory if using WP-CLI.

Impact Analysis

Attackers could download sensitive files like login credentials, backups, or configuration files. This could lead to data breaches, unauthorized access, or further exploitation of the website.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if sensitive personal or health data is exposed. Organizations may face legal penalties, fines, or reputational damage due to data breaches.

Mitigation Strategies

Immediately update OMGF Pro to version 5.2.8 or later. If an update is not immediately available, apply Patchstack's mitigation rule to block attacks until the update is applied. Remove or disable the plugin if no update is possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart