CVE-2025-12640: fallo de gravedad media en premio Folders – Unlimited Folders to Organize…
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.2%
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
premio · Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File ManagerCVEs relacionadas — premio Folders – Unlimited Folders to Organize…
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-2023MEDIUMFolders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_uploadEPSS 0.7%CVE-2024-7317MEDIUMFolders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-3868MEDIUMFolders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last NameEPSS 0.4%CVE-2025-12971MEDIUMFolders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content ManipulationEPSS 0.2%