CVE-2024-7858: Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions
The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions related to managing media files and folder along with controlling settings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7858?
CVE-2024-7858 has a high severity rating due to the potential for unauthorized access to sensitive media files.
How do I fix CVE-2024-7858?
To fix CVE-2024-7858, update the Media Library Folders plugin to version 8.2.4 or higher.
Who is affected by CVE-2024-7858?
All versions of the Media Library Folders plugin for WordPress up to and including version 8.2.3 are affected by CVE-2024-7858.
What kind of attack can exploit CVE-2024-7858?
CVE-2024-7858 can be exploited by authenticated attackers to gain unauthorized access to the media library functions.
Is there a known exploit for CVE-2024-7858?
As of now, there are no publicly reported exploits specifically targeting CVE-2024-7858.