Media Library Folders <= 8.4.3 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Attachment Move/Copy

ID

WPSEC-2026-2370

Plugin

Media Library Folders (media-library-plus)

Affected

all versions before 8.4.4

Remediation

Update to 8.4.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness

CWE-639

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03

Attack surface

Media Library Folders on WPSec AttackSurface

Fix released

2026-11-02

Published

2026-11-03

Description

The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference via the mlfp_process_mc_data AJAX action (move_copy_file function) in all versions up to, and including, 8.4.3, due to missing validation that the current user owns the attachments named in the user-controlled 'serial_copy_ids' key and missing validation of the destination 'folder_id'. This makes it possible for authenticated attackers, with Author-level access and above, to move or copy media files belonging to other users between folders, and to move protected files out of the protected directory.

References

• https://wpsec.com/vuln/WPSEC-2026-2370/
• https://plugins.svn.wordpress.org/media-library-plus/tags/8.4.4/
• https://wordpress.org/plugins/media-library-plus/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS