Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Folder Structure Modification
- ID
- WPSEC-2026-0370
- Plugin
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager (folders)
- Affected
- from 3.2.1 before 3.2.3
- Remediation
- Update to 3.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the folders-settings/v1 REST routes lock-unlock-all-folders, update-folder-color, save-folder-position, sort-folder-data and copy-folder in versions 3.2.1 to 3.2.2. The routes only require a logged-in user, and the handlers only verified a nonce that the plugin prints on every folder-enabled list screen, although the folder taxonomies require the manage_categories capability (which the equivalent handlers enforced before 3.2.1). This makes it possible for authenticated attackers, with contributor-level access and above, to lock or unlock arbitrary folders, change folder colors, move and reorder folders, change the folder sort order and create new folders by copying existing ones.
References
- https://wpsec.com/vuln/WPSEC-2026-0370/
- https://plugins.svn.wordpress.org/folders/tags/3.2.3/
- https://wordpress.org/plugins/folders/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS