CVE-2026-2312: Media Library Folders Auth Bypass Flaw

CVE-2026-2312 Overview

The Media Library Folders plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 8.3.6. The vulnerability exists in the delete_maxgalleria_media() and maxgalleria_rename_image() functions due to missing validation on a user-controlled key. This security flaw allows authenticated attackers with Author-level access or above to delete or rename media attachments owned by other users, including administrators. Additionally, the rename functionality deletes all postmeta for the target attachment, resulting in significant data loss.

Critical Impact

Authenticated attackers with minimal Author-level privileges can manipulate or destroy media assets belonging to any user, including administrators, leading to unauthorized data modification and potential data loss across WordPress sites using this plugin.

Affected Products

• Media Library Folders plugin for WordPress versions up to and including 8.3.6

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-2312 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2312

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when software fails to perform proper authorization checks before allowing access to a resource or functionality. In this case, the Media Library Folders plugin does not adequately validate that the requesting user has ownership or appropriate permissions over the media attachment being manipulated.

The plugin exposes two vulnerable functions that accept user-controlled input to identify target media attachments. The delete_maxgalleria_media() function processes deletion requests without verifying that the authenticated user owns the attachment being deleted. Similarly, the maxgalleria_rename_image() function allows renaming of any attachment regardless of ownership. The rename operation is particularly destructive as it also purges all associated postmeta data, which can include critical metadata, custom fields, and plugin-specific data attached to the media item.

Root Cause

The root cause of this vulnerability is the absence of ownership validation in the affected functions. When processing requests to delete or rename media attachments, the plugin accepts an attachment ID directly from user input without checking whether the authenticated user has the authority to modify that specific attachment. This missing authorization check allows horizontal privilege escalation, where a user can access or modify resources belonging to other users at the same or higher privilege level.

Attack Vector

An attacker with Author-level access to a WordPress site can exploit this vulnerability through the network by sending crafted requests to the vulnerable plugin endpoints. The attack requires no user interaction and can be executed with low complexity.

The attacker can enumerate attachment IDs and target any media file on the system. By calling the delete_maxgalleria_media() function with a target attachment ID, the attacker can delete media files owned by administrators or other users. Using the maxgalleria_rename_image() function, the attacker can rename attachments and, critically, trigger the deletion of all postmeta associated with those attachments.

The vulnerability exploitation flow involves the attacker authenticating with valid Author credentials, identifying target attachment IDs through enumeration or reconnaissance, and then sending requests to the vulnerable functions with the target attachment IDs. The plugin processes these requests without ownership verification, resulting in unauthorized deletion, renaming, or data loss affecting media assets belonging to other users.

Detection Methods for CVE-2026-2312

Indicators of Compromise

• Unexpected deletion of media attachments, particularly those owned by administrator accounts
• Missing postmeta data on media attachments that previously had associated metadata
• Unusual activity patterns from Author-level accounts interacting with media files they did not upload
• WordPress database logs showing DELETE or UPDATE operations on wp_postmeta for attachments not owned by the requesting user

Detection Strategies

• Monitor WordPress activity logs for calls to delete_maxgalleria_media() and maxgalleria_rename_image() functions targeting attachments not owned by the requesting user
• Implement file integrity monitoring on the WordPress uploads directory to detect unexpected file deletions or renames
• Review access logs for patterns of attachment ID enumeration from Author-level accounts
• Deploy web application firewall (WAF) rules to detect and alert on suspicious patterns in requests to Media Library Folders plugin endpoints

Monitoring Recommendations

• Enable comprehensive WordPress activity logging using a security plugin to track all media library operations
• Set up alerts for bulk deletion or modification of media attachments
• Monitor for Author-level accounts accessing or modifying administrative media assets
• Review plugin-specific logs if available for anomalous request patterns

How to Mitigate CVE-2026-2312

Immediate Actions Required

• Update the Media Library Folders plugin to the latest patched version immediately
• Audit recent media library activity to identify potential exploitation attempts
• Review all Author-level and above user accounts for suspicious activity
• Consider temporarily restricting Author-level access to the media library until patching is complete

Patch Information

A patch for this vulnerability is available. The security fix can be reviewed in the WordPress Plugin Change Log. Site administrators should update to the latest version of the Media Library Folders plugin that includes authorization checks in the delete_maxgalleria_media() and maxgalleria_rename_image() functions.

For additional technical details and vulnerability intelligence, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict Author-level access to trusted users only until the plugin is updated
• Implement additional access controls at the server level to limit access to plugin AJAX endpoints
• Use a web application firewall to filter requests to vulnerable plugin functions
• Consider temporarily disabling the Media Library Folders plugin if it is not critical to operations until a patch can be applied