CVE-2025-12640: WordPress Folders Plugin Auth Bypass Flaw

CVE-2025-12640 Overview

CVE-2025-12640 is an authorization bypass vulnerability affecting the Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress. The vulnerability exists due to missing object-level authorization checks in the handle_folders_file_upload() function, enabling authenticated attackers with Author-level access or above to replace arbitrary media files in the WordPress Media Library.

Critical Impact

Authenticated attackers can replace legitimate media files with malicious content, potentially enabling phishing attacks, defacement, or distribution of malware through trusted WordPress sites.

Affected Products

• Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress versions up to and including 3.1.5
• WordPress installations using the affected Folders plugin versions
• Any WordPress site with Author-level or higher user accounts and the vulnerable plugin installed

Discovery Timeline

• 2026-01-08 - CVE CVE-2025-12640 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-12640

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when a software component fails to perform an authorization check when an actor attempts to access a resource or perform an action. The vulnerable handle_folders_file_upload() function processes file upload requests but does not validate whether the authenticated user has legitimate ownership or permissions over the target media file they are attempting to replace.

The attack requires network access and authentication at the Author level or higher. While the scope is limited to integrity impacts without direct confidentiality or availability concerns, the ability to replace arbitrary media files poses significant risks for content integrity and could be leveraged for more sophisticated attacks such as phishing campaigns or site defacement.

Root Cause

The root cause is the absence of object-level authorization checks within the handle_folders_file_upload() function. When processing media replacement requests, the function verifies that the user is authenticated and has at least Author-level privileges but fails to confirm whether the user actually owns or has permission to modify the specific media file being targeted. This authorization gap allows any authenticated user meeting the minimum role requirement to replace media files belonging to other users or administrators.

Attack Vector

The vulnerability is exploitable over the network by authenticated attackers. An attacker with Author-level access to the WordPress installation can craft requests to the handle_folders_file_upload() function, specifying a target media file ID belonging to any user. Since the function lacks proper object-level authorization, it processes the replacement request without verifying ownership.

The attack flow typically involves:

1. Attacker authenticates to WordPress with Author-level (or higher) credentials
2. Attacker identifies target media file IDs through enumeration or prior knowledge
3. Attacker submits a crafted upload request to replace the target file
4. The vulnerable function processes the request without ownership validation
5. The original media file is replaced with attacker-controlled content

Detection Methods for CVE-2025-12640

Indicators of Compromise

• Unexpected changes to media file metadata or modification timestamps without corresponding legitimate user activity
• Media files with content that differs from expected originals, particularly images or documents that appear altered
• Audit log entries showing Author-level users accessing or modifying media files they did not originally upload
• Increased activity targeting the handle_folders_file_upload() endpoint from authenticated sessions

Detection Strategies

• Implement WordPress audit logging to track all media library modifications with user attribution
• Monitor for unusual patterns of media file replacements, especially across multiple files in short time periods
• Review access logs for repeated requests to plugin-specific upload handlers from non-administrative users
• Compare media file hashes against known-good backups to identify unauthorized modifications

Monitoring Recommendations

• Enable comprehensive logging for the WordPress Media Library and Folders plugin activities
• Set up alerts for media file modifications by users who are not the original uploaders
• Periodically audit Author and Contributor account activities for anomalous behavior
• Implement file integrity monitoring on the WordPress uploads directory

How to Mitigate CVE-2025-12640

Immediate Actions Required

• Update the Folders plugin to version 3.1.6 or later immediately
• Audit recent media library activity to identify any unauthorized file replacements
• Review all Author-level and above user accounts for legitimacy and necessity
• Consider temporarily restricting Author-level capabilities if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Folders plugin version 3.1.6. The patch adds proper object-level authorization checks to the handle_folders_file_upload() function to ensure users can only replace media files they have legitimate permission to modify. Technical details of the fix can be reviewed in the WordPress plugin changeset. Additional vulnerability information is available in the Wordfence vulnerability report.

Workarounds

• Temporarily disable the Folders plugin until the update can be applied
• Restrict Author-level accounts to only trusted users with verified need for media upload capabilities
• Implement additional server-side access controls to limit which users can modify specific media directories
• Use a Web Application Firewall (WAF) rule to restrict access to the vulnerable endpoint while awaiting patch deployment

# WordPress CLI command to update the Folders plugin
wp plugin update folders --version=3.1.6

# Verify current plugin version
wp plugin get folders --field=version

# List recent media library modifications for audit
wp db query "SELECT * FROM wp_posts WHERE post_type='attachment' AND post_modified > DATE_SUB(NOW(), INTERVAL 7 DAY) ORDER BY post_modified DESC;"