CVE-2026-2312 is an authorization bypass vulnerability in the Media Library Folders WordPress plugin due to missing validation on a user-controlled key in the delete_maxgalleria_media() and maxgalleria_rename_image() functions. This allows authenticated users with Author-level privileges or higher to delete or rename attachments owned by other users, including administrators. The rename function additionally deletes all postmeta for the affected attachment, resulting in data loss. The vulnerability affects all versions up to and including 8.3.6. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low complexity and requiring authenticated privileges.

Exploitation allows authenticated users with Author-level or higher privileges to modify or delete media attachments belonging to other users, including administrators. This can lead to unauthorized data modification and loss of postmeta data associated with renamed attachments. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — no official patch or remediation information is provided in the vendor advisory. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict Author-level access to trusted users only to reduce risk.