CVE-2025-12971: WordPress Folders Plugin Auth Bypass Flaw

CVE-2025-12971 Overview

CVE-2025-12971 is a broken access control vulnerability [CWE-863] in the Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress. The flaw affects all versions up to and including 3.1.5. The plugin's wcp_change_post_folder function performs a misconfigured capability check, allowing authenticated users with Contributor-level access or higher to move arbitrary folder contents to arbitrary folders. This weakens content organization integrity across affected WordPress sites and can enable attackers to disrupt editorial workflows or expose files by relocating them into folders they should not control.

Critical Impact

Authenticated attackers with Contributor privileges can reorganize arbitrary folder contents on affected WordPress sites, undermining content integrity.

Affected Products

• WordPress Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin
• All plugin versions up to and including 3.1.5
• WordPress sites that expose Contributor-level (or higher) accounts to untrusted users

Discovery Timeline

• 2025-11-27 - CVE-2025-12971 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12971

Vulnerability Analysis

The vulnerability resides in the wcp_change_post_folder function inside the Folders plugin's folders.class.php file. This handler is exposed to authenticated requests but does not enforce a capability check that limits which posts or folders a user may modify. As a result, any authenticated user with at least Contributor privileges can invoke the function and change the folder associated with content they do not own. The impact is limited to integrity of folder assignments; the flaw does not directly expose data confidentiality or affect site availability. However, on multi-author sites, attackers can disrupt editorial organization, hide posts from expected workflows, or move media into folders visible to other roles.

Root Cause

The root cause is a missing or incorrect authorization check [CWE-863] in the wcp_change_post_folder handler. The plugin verifies that the caller is authenticated but does not verify that the caller owns the target post or has the capability to edit it. This violates the principle of least privilege for a low-trust role such as Contributor.

Attack Vector

Exploitation requires an authenticated session at Contributor level or higher. The attacker sends a crafted request to the plugin's AJAX endpoint that invokes wcp_change_post_folder, supplying arbitrary post identifiers and destination folder identifiers. Because the endpoint is reachable over the network without additional user interaction, exploitation is straightforward once valid credentials are obtained. Refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Analysis for the affected code path and request structure.

Detection Methods for CVE-2025-12971

Indicators of Compromise

• Unexpected AJAX POST requests to admin-ajax.php with action=wcp_change_post_folder originating from Contributor or Author accounts.
• Posts or media items suddenly reassigned to folders outside of an author's normal working set.
• Audit log entries showing folder reassignment activity performed by low-privilege users at unusual times.

Detection Strategies

• Inspect WordPress access logs for calls to wcp_change_post_folder and correlate the invoking user role with the ownership of the target post ID.
• Deploy a Web Application Firewall rule that blocks or alerts on wcp_change_post_folder requests where the actor is not an Editor or Administrator.
• Compare current folder-to-post mappings against a known-good baseline snapshot to identify unauthorized reassignments.

Monitoring Recommendations

• Enable plugin and role audit logging so all folder reassignment events are captured with user, timestamp, and target IDs.
• Alert when a single low-privilege account triggers repeated wcp_change_post_folder calls in a short window.
• Forward WordPress and web server logs to a centralized SIEM or data lake for cross-site correlation and long-term retention.

How to Mitigate CVE-2025-12971

Immediate Actions Required

• Update the Folders plugin to a version later than 3.1.5 that includes the fix from WordPress Change Set #3402986.
• Audit existing Contributor and Author accounts and remove any that are unused, stale, or unnecessary.
• Review recent folder assignments to identify and revert any unauthorized changes.

Patch Information

The vendor addressed the missing authorization check in the Folders plugin repository via WordPress Change Set #3402986. Site administrators should upgrade to the patched release published after version 3.1.5. Additional analysis is available in the CleanTalk CVE-2025-12971 Research and Wordfence Vulnerability Analysis.

Workarounds

• Temporarily deactivate the Folders plugin until the patched version can be applied.
• Restrict new user registrations and limit Contributor-level access to trusted personnel only.
• Add a WAF rule that blocks unauthenticated or low-privilege requests to admin-ajax.php with action=wcp_change_post_folder.

# Example WAF rule (ModSecurity) to block low-trust access to the vulnerable action
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1029712,\
   msg:'Block CVE-2025-12971 wcp_change_post_folder abuse'"
  SecRule ARGS:action "@streq wcp_change_post_folder" "t:none"