Executive Summary

This vulnerability exists in the Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress, versions up to and including 3.1.5. It is caused by missing object-level authorization checks in the handle_folders_file_upload() function, which allows authenticated users with Author-level access or higher to replace arbitrary media files in the WordPress Media Library without proper permission checks. [1]

Useful 0 Not Useful 0

Impact Analysis

An attacker with Author-level access or higher can exploit this vulnerability to replace arbitrary media files in the WordPress Media Library. This could lead to unauthorized modification of media content, potentially allowing the attacker to upload malicious files or alter existing media, which may compromise the integrity and trustworthiness of the website's content. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your WordPress installation is running the Folders plugin version 3.1.5 or earlier. Additionally, monitoring for unauthorized media file replacements by authenticated users with Author-level access or higher could indicate exploitation attempts. There are no specific commands provided in the resources to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Folders plugin to version 3.1.6 or later, which includes security enhancements that enforce strict permission checks in the handle_folders_file_upload() function. This update ensures that only users with both the 'edit_post' capability on the specific attachment and the 'upload_files' capability can replace media files, preventing unauthorized arbitrary media replacement. [1]

Useful 0 Not Useful 0