Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Arbitrary File Upload via Media Replace
- ID
- WPSEC-2026-0084
- Plugin
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager (folders)
- Affected
- from 3.2.1 before 3.2.2
- Remediation
- Update to 3.2.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Folders plugin for WordPress is vulnerable to arbitrary file uploads via the media replace feature (handle_folders_file_upload) in version 3.2.1. The 3.2.1 code rewrite dropped the image-only extension and MIME allowlist that versions 2.9.4 through 3.2.0 enforced, leaving only a check that accepted a file whenever its client-supplied MIME type was in the allowed list, while the stored file's extension was taken from the user-supplied file name. This makes it possible for authenticated attackers with Author-level access and above (users with the upload_files capability) to replace an attachment they can edit with a file carrying a dangerous extension such as .php, which may make remote code execution possible.
References
- https://wpsec.com/vuln/WPSEC-2026-0084/
- https://plugins.svn.wordpress.org/folders/tags/3.2.2/
- https://wordpress.org/plugins/folders/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS