← back to popular plugins
wordfence / plugin · folders

Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager

folders
total installs
90,000
total vulns
2
critical
0
high
0
medium
2
low
0
latest vuln
—
patched
2
unpatched
0
avg time to patch
—
vulnerabilities (2)
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement
medium ✓ patched
cve id CVE-2025-12640 ↗
cvss score 4.3
cwe CWE-862: Missing Authorization
published Jan 7, 2026
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation
medium ✓ patched
cve id CVE-2025-12971 ↗
cvss score 4.3
cwe CWE-863: Incorrect Authorization
published Nov 26, 2025
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders.