CVE-2026-24569: Media Library File Size Auth Bypass Issue

CVE-2026-24569 Overview

CVE-2026-24569 is a Missing Authorization vulnerability discovered in the Sully Media Library File Size WordPress plugin. This security flaw allows attackers to exploit incorrectly configured access control security levels, potentially exposing sensitive information to unauthorized users. The vulnerability stems from a Broken Access Control condition (CWE-862) that fails to properly verify user permissions before granting access to protected functionality.

Critical Impact

Authenticated attackers with low privileges can bypass authorization controls to access information they should not have permission to view, potentially exposing sensitive media library data.

Affected Products

• Sully Media Library File Size WordPress plugin versions up to and including 1.6.7
• WordPress installations using the vulnerable media-library-file-size plugin

Discovery Timeline

• 2026-01-23 - CVE CVE-2026-24569 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-24569

Vulnerability Analysis

This vulnerability is classified as Missing Authorization (CWE-862), a type of Broken Access Control flaw. The Media Library File Size plugin fails to implement proper authorization checks on certain functionality, allowing authenticated users with minimal privileges to access resources or perform actions that should be restricted to higher-privileged users.

The attack requires network access and a low-privileged authenticated user account. Once authenticated, an attacker can exploit the misconfigured access controls without any user interaction required. The impact is limited to unauthorized information disclosure, with no ability to modify data or affect system availability.

Root Cause

The root cause of this vulnerability is the absence of proper capability or permission checks within the plugin's code paths. WordPress plugins are expected to verify user capabilities using functions like current_user_can() before executing privileged operations. The Media Library File Size plugin fails to implement these checks adequately, creating an authorization bypass condition that allows low-privileged users to access restricted functionality.

Attack Vector

The attack is executed over the network by an authenticated user with low-level privileges (such as a Subscriber role in WordPress). The attacker can send crafted requests to the plugin's endpoints that lack proper authorization verification. Because no user interaction is required and the attack complexity is low, exploitation is straightforward for any authenticated attacker who understands the vulnerable functionality.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Database Entry.

Detection Methods for CVE-2026-24569

Indicators of Compromise

• Unusual access patterns to media library endpoints from low-privileged user accounts
• Unexpected requests to plugin-specific AJAX handlers or REST API endpoints
• Access logs showing authenticated users querying media information beyond their normal usage patterns
• Anomalous file size enumeration or media metadata queries from non-administrative accounts

Detection Strategies

• Monitor WordPress access logs for requests to media-library-file-size plugin endpoints from non-administrative users
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious plugin interactions
• Review WordPress user activity logs for permission-escalation attempts or unusual media library access
• Deploy SentinelOne Singularity to detect anomalous application behavior and unauthorized access attempts

Monitoring Recommendations

• Enable comprehensive WordPress audit logging to track all user actions within the media library
• Configure alerts for access control violations or authorization failures in web server logs
• Regularly review user permissions and plugin configurations for potential misconfigurations
• Implement real-time monitoring for WordPress plugin vulnerabilities using security scanning tools

How to Mitigate CVE-2026-24569

Immediate Actions Required

• Update the Media Library File Size plugin to a patched version when available from the vendor
• Temporarily disable the media-library-file-size plugin if it is not essential to site operations
• Review and restrict user roles to minimize the number of authenticated users on the WordPress installation
• Implement additional access controls at the web server or WAF level to restrict plugin functionality

Patch Information

Organizations should monitor the WordPress plugin repository and the Patchstack Vulnerability Database for security updates addressing this vulnerability. Until a patch is released, consider implementing the workarounds described below. Affected versions include all releases through 1.6.7.

Workarounds

• Disable the Media Library File Size plugin until a security patch is available
• Restrict WordPress user registration and remove unnecessary user accounts with authenticated access
• Implement IP-based access restrictions for the WordPress admin area and authenticated functionality
• Use a Web Application Firewall (WAF) to add an additional layer of access control
• Consider alternative plugins that provide similar functionality with proper authorization controls

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate media-library-file-size

# Verify plugin is deactivated
wp plugin status media-library-file-size