Unauthorized Access to Media Files and Folders via Missing Capability Checks

CVE-2024-7858

Summary

The Media Library Folders plugin for WordPress is exposed to unauthorized access because of insufficient capability checks on multiple AJAX functions found in the media-library-plus.php file. This weakness affects all versions of the plugin through 8.2.3, allowing authenticated attackers with subscriber-level permission or higher to execute various actions that can manipulate media files and folders, as well as alter plugin settings. This vulnerability highlights the critical need for rigorous access controls within WordPress plugins to protect against potential insider threats.

References