Vulnerability Description
The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions related to managing media files and folder along with controlling settings.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Maxfoundry | Media Library Folders | < 8.2.4 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-librarProduct
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc0fc00-b7d6-429c-9abThird Party Advisory
FAQ
What is CVE-2024-7858?
CVE-2024-7858 is a vulnerability with a CVSS score of 6.3 (MEDIUM). The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to,...
How severe is CVE-2024-7858?
CVE-2024-7858 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-7858?
Check the references section above for vendor advisories and patch information. Affected products include: Maxfoundry Media Library Folders.