Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.1 - Authenticated (Author+) Insecure Direct Object Reference to Arbitrary Attachment File Rename
- ID
- WPSEC-2026-0086
- Plugin
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager (folders)
- Affected
- all versions before 3.2.2
- Remediation
- Update to 3.2.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.1 via the premio_folder_replace_name_with_title AJAX action due to missing validation on a user-controlled key. The handler only verified a per-attachment nonce, which the plugin printed in the media modal for every attachment to any user with the upload_files capability, and never checked whether the current user could edit the targeted attachment. This makes it possible for authenticated attackers with Author-level access and above to rename the files and change the titles and slugs of attachments they do not own.
References
- https://wpsec.com/vuln/WPSEC-2026-0086/
- https://plugins.svn.wordpress.org/folders/tags/3.2.2/
- https://wordpress.org/plugins/folders/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS