Media Library Folders <= 8.4.3 - Authenticated (Author+) Insecure Direct Object Reference to Block Direct Access Settings and Protection of Other Users' Attachments
- ID
- WPSEC-2026-2369
- Plugin
- Media Library Folders (media-library-plus)
- Affected
- from 8.1.0 before 8.4.4
- Remediation
- Update to 8.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- Media Library Folders on WPSec AttackSurface
- Fix released
- Published
Description
The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference via the mlfp_toggle_file_access, mlfp_display_bda_info and mlfp_update_bda_record AJAX actions in all versions from 8.1.0 up to, and including, 8.4.3, due to missing validation that the current user owns or may edit the attachment named by the user-controlled 'file_id'/'image_id' key. The handlers check only the upload_files capability. This makes it possible for authenticated attackers, with Author-level access and above, to protect or unprotect any attachment, including files owned by other users. This moves the files into or out of the protected directory, exposes protected files or breaks public ones, and deletes their thumbnails. Attackers can also read the private download link hash, download count, limit and expiration date of other users' protected files, and change their download limits and expiration dates.
References
- https://wpsec.com/vuln/WPSEC-2026-2369/
- https://plugins.svn.wordpress.org/media-library-plus/tags/8.4.4/
- https://wordpress.org/plugins/media-library-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS