The Media Library Folders plugin for WordPress suffers from a second order SQL Injection vulnerability via the 'sort_type' parameter in the 'mlf_change_sort_type' AJAX action. This flaw is due to insufficient escaping of user input and inadequate preparation of the existing SQL query, enabling authenticated users with subscriber-level privileges or above to append malicious SQL code. This can be exploited to extract sensitive information from the database without impacting availability or integrity. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity and requiring privileges. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an authenticated user with subscriber-level access or higher to perform SQL Injection attacks that can extract sensitive information from the database. The vulnerability does not affect system availability or integrity but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to the 'mlf_change_sort_type' AJAX action. Avoid exposing this plugin on publicly accessible sites without additional protective controls.