# Media Library Folders <= 8.4.3 - Authenticated (Author+) Insecure Direct Object Reference to Block Direct Access Settings and Protection of Other Users' Attachments

- **ID:** WPSEC-2026-2369
- **Plugin:** Media Library Folders (`media-library-plus`), https://wordpress.org/plugins/media-library-plus/
- **Affected versions:** from 8.1.0 before 8.4.4
- **Fixed in:** 8.4.4 (Update to 8.4.4 or later.)
- **Severity:** Medium 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/media-library-plus
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2369/

## Description

The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference via the mlfp_toggle_file_access, mlfp_display_bda_info and mlfp_update_bda_record AJAX actions in all versions from 8.1.0 up to, and including, 8.4.3, due to missing validation that the current user owns or may edit the attachment named by the user-controlled 'file_id'/'image_id' key. The handlers check only the upload_files capability. This makes it possible for authenticated attackers, with Author-level access and above, to protect or unprotect any attachment, including files owned by other users. This moves the files into or out of the protected directory, exposes protected files or breaks public ones, and deletes their thumbnails. Attackers can also read the private download link hash, download count, limit and expiration date of other users' protected files, and change their download limits and expiration dates.

## References

- https://wpsec.com/vuln/WPSEC-2026-2369/
- https://plugins.svn.wordpress.org/media-library-plus/tags/8.4.4/
- https://wordpress.org/plugins/media-library-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2369/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.