Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.2.2 - Unauthenticated Sensitive Information Exposure via Predictable Folder Download Archive
- ID
- WPSEC-2026-0371
- Plugin
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager (folders)
- Affected
- from 3.2.1 before 3.2.3
- Remediation
- Update to 3.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 3.2.1 to 3.2.2 because the 'Download folder' feature writes a ZIP archive of the folder's media files to the public uploads directory under a name derived only from the folder name (uploads/folders-files/{folder-slug}.zip) and never deletes it. This makes it possible for unauthenticated attackers who guess a folder's name to download the archive, including files that are not otherwise listed publicly (for example media attached to unpublished posts or kept behind an access-control plugin), once a user with the upload_files capability has downloaded that folder.
References
- https://wpsec.com/vuln/WPSEC-2026-0371/
- https://plugins.svn.wordpress.org/folders/tags/3.2.3/
- https://wordpress.org/plugins/folders/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS