Authorization Bypass in Mediamatic Media Library Folders Plugin for WordPress
CVE-2023-0293

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Mediamatic – Media Library Folders
Vendor
CVE Published:
13 January 2023

Summary

The Mediamatic – Media Library Folders plugin for WordPress contains an authorization bypass issue due to a lack of capability checks on its AJAX actions. This vulnerability affects versions up to and including 2.8.1, allowing authenticated attackers with subscriber-level permissions or higher to modify image categories. This manipulation can disrupt the organization of images in folder views, presenting a significant risk for sites relying on this plugin for media management.

Affected Version(s)

Mediamatic – Media Library Folders * <= 2.8.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mediamatic/tru...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.