Description
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.
Problem types
Product status
* (semver)
Timeline
| 2025-12-12: | Disclosed |
Credits
Athiwat Tiprasaharn
References
www.wordfence.com/...-7baa-4bc0-879f-cc7df1ea13d2?source=cve
plugins.trac.wordpress.org/...trollers/FoldersController.php
plugins.trac.wordpress.org/...cludes/Models/FoldersModel.php
plugins.trac.wordpress.org/changeset/3417928/
Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.