PT-2026-8102 · WordPress · Media Library Folders

Shivanandsnaidu · Published 2026-02-14 · Updated 2026-02-14 · CVE-2026-2312

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Media Library Folders plugin for WordPress versions up to and including 8.3.6

Description The software contains an Insecure Direct Object Reference issue. This allows authenticated attackers with Author-level access or higher to delete or rename attachments belonging to other users, including administrators. The rename process also removes all postmeta associated with the targeted attachment, resulting in data loss. The issue is present due to a lack of validation on a user-controlled key within the delete maxgalleria media() and maxgalleria rename image() functions.

Recommendations Versions prior to 8.3.7 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2312

Affected Products

Media Library Folders

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2312 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ccf77cb1-b6b6-49de-8de4-20eddd3b5e62?source=cve · Note
• https://t.me/cveNotify/152037 · Telegram Post
• https://t.me/CVEtracker/44721 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3459947/media-library-plus · Note
• https://twitter.com/CVEnew/status/2022638308531024223 · Twitter Post