PT-2026-8102 · WordPress · Media Library Folders

Shivanandsnaidu · Publicado 2026-02-14 · Atualizado 2026-02-14 · CVE-2026-2312

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Media Library Folders plugin for WordPress versions up to and including 8.3.6

Description The software contains an Insecure Direct Object Reference issue. This allows authenticated attackers with Author-level access or higher to delete or rename attachments belonging to other users, including administrators. The rename process also removes all postmeta associated with the targeted attachment, resulting in data loss. The issue is present due to a lack of validation on a user-controlled key within the delete maxgalleria media() and maxgalleria rename image() functions.

Recommendations Versions prior to 8.3.7 should be updated.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2312

Produtos afetados

Media Library Folders

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/ccf77cb1-b6b6-49de-8de4-20eddd3b5e62?source=cve · Nota
• https://t.me/cveNotify/152037 · Publicação no Telegram
• https://t.me/CVEtracker/44721 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3459947/media-library-plus · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2312 · Nota de Segurança
• https://twitter.com/CVEnew/status/2022638308531024223 · Publicação no Twitter