The Media Library Folders WordPress plugin suffers from a missing authorization vulnerability (CWE-862) due to absent capability checks on multiple AJAX endpoints within media-library-plus.php. This allows authenticated users with low privileges (subscriber and above) to execute unauthorized operations on media files, folders, and plugin settings. The vulnerability affects all versions up to and including 8.2.3. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with subscriber-level access can exploit this vulnerability to perform unauthorized actions on media library folders and settings, potentially leading to unauthorized disclosure, modification, or disruption of media management within the WordPress site. This could undermine the integrity and availability of media assets managed by the plugin. However, exploitation requires at least authenticated subscriber access, limiting the attack surface.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should consider restricting subscriber-level access or disabling the Media Library Folders plugin if possible. Monitoring for updates from maxfoundry and applying patches promptly upon release is recommended.