Medium severity4.3NVD Advisory· Published Jan 8, 2026· Updated Apr 15, 2026
CVE-2025-12640
CVE-2025-12640
Description
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Folders/Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Managerllm-createRange: <=3.1.5
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.