The Media Library Folders plugin for WordPress suffers from a missing capability check (CWE-862) on multiple AJAX actions. This flaw enables authenticated users with Author-level privileges or above to modify plugin settings without proper authorization. The vulnerability impacts all versions up to 8.3.0 and allows changes to sensitive settings such as IP-blocking. The CVSS v3.1 base score is 4.3, reflecting a medium severity with low complexity and no user interaction required. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

An attacker with Author-level access or higher can alter plugin settings, potentially affecting security controls like IP-blocking. While this does not directly lead to data confidentiality loss or denial of service, it can weaken security postures by modifying protection mechanisms. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for unauthorized changes to plugin settings. Avoid granting Author or higher privileges to untrusted users.