CVE-2024-2023 is a directory traversal vulnerability affecting the premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager WordPress plugins. The issue resides in the 'handle_folders_file_upload' function, permitting authenticated users with author privileges or above to upload files outside the intended directories. This improper limitation of pathname allows attackers to place files in arbitrary server locations, potentially leading to unauthorized file uploads and modification. The vulnerability affects all versions up to 3.0 for Folders and 3.0.2 for Folders Pro. The CVSS 3.1 score is 4.3, reflecting a medium impact primarily on integrity.

An authenticated user with author-level permissions or higher can exploit this vulnerability to upload files to arbitrary locations on the server. This could lead to unauthorized modification of server files or placement of malicious files, impacting the integrity of the system. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and monitor plugin updates from premio for a security patch. Avoid granting author or higher privileges to untrusted users to reduce risk.