CVE-2025-0935

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0935", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-31T15:53:56.541Z", "datePublished": "2025-02-15T08:25:05.509Z", "dateUpdated": "2026-04-08T16:59:55.958Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:55.958Z"}, "affected": [{"vendor": "maxfoundry", "product": "Media Library Folders", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking."}], "title": "Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f810102-cf25-4898-a3a6-3cdc9a96aaea?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L697"}, {"url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L6296"}, {"url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L7198"}, {"url": "https://plugins.trac.wordpress.org/changeset/3234676/media-library-plus/trunk/media-library-plus.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Brian Sans-Souci"}], "timeline": [{"time": "2025-02-14T20:08:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-18T21:12:20.052160Z", "id": "CVE-2025-0935", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T21:12:36.868Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0935", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-18T21:12:20.052160Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T21:12:29.988Z"}}], "cna": {"title": "Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change", "credits": [{"lang": "en", "type": "finder", "value": "Brian Sans-Souci"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "maxfoundry", "product": "Media Library Folders", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "8.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-14T20:08:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f810102-cf25-4898-a3a6-3cdc9a96aaea?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L697"}, {"url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L6296"}, {"url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L7198"}, {"url": "https://plugins.trac.wordpress.org/changeset/3234676/media-library-plus/trunk/media-library-plus.php"}], "descriptions": [{"lang": "en", "value": "The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-02-15T08:25:05.509Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0935", "state": "PUBLISHED", "dateUpdated": "2025-02-18T21:12:36.868Z", "dateReserved": "2025-01-31T15:53:56.541Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-15T08:25:05.509Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Media Library Folders", "vendor": "maxfoundry", "versions": [{"lessThanOrEqual": "8.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:maxfoundry:media_library_folders:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "B965552E-110E-4C85-AE03-2EE9703AF6B2", "versionEndExcluding": "8.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking."}, {"lang": "es", "value": "El complemento Media Library Folders para WordPress es vulnerable a cambios no autorizados en la configuraci\u00f3n del complemento debido a una falta de verificaci\u00f3n de capacidad en varias acciones AJAX en todas las versiones hasta la 8.3.0 incluida. Esto permite que atacantes autenticados, con acceso de nivel de autor y superior, cambien la configuraci\u00f3n del complemento relacionada con cuestiones como el bloqueo de IP."}], "id": "CVE-2025-0935", "lastModified": "2026-06-17T08:27:23.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0935", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-18T21:12:20.052160Z", "version": "2.0.3"}}]}, "published": "2025-02-15T09:15:10.583", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L6296"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L697"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L7198"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3234676/media-library-plus/trunk/media-library-plus.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f810102-cf25-4898-a3a6-3cdc9a96aaea?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:29:10.363537+00:00", "value": {"mitigation_remediation": ["Upgrade the Media Library Folders plugin to version 8.3.1 or later, which includes proper capability checks on AJAX actions.", "Restrict the ability to modify critical settings, such as IP\u2011blocking, to Administrators only by reviewing and updating the plugin\u2019s role\u2011based access controls.", "Enable monitoring for changes to plugin settings and review audit logs to detect any unauthorized modifications promptly."], "summary": {"action": "Patch", "impact": "Unauthorized configuration change via authentication bypass"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the MaxFoundry Media Library Folders plugin for WordPress, specifically all releases up to and including version 8.3.0. Users running any of these versions are susceptible to the described authorization bypass.", "description_and_impact": "The Media Library Folders plugin contains a missing capability check on several AJAX actions, which allows an authenticated user with Author level or higher to modify plugin settings, including IP\u2011blocking rules. By changing these settings, the attacker can alter how visitor requests are handled, potentially weakening site security or making the site more vulnerable to other attacks. The primary impact is configuration tampering, leading to degraded security controls and increased attack surface.", "risk_and_exploitability": "The CVSS score of 4.3 indicates a low severity issue, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be authenticated with at least Author privileges and must trigger the vulnerable AJAX actions; no additional privilege escalation is required. While the risk is moderate due to the low likelihood, the potential for configuration manipulation warrants timely remediation."}}}}, "created": "2026-04-22T13:30:17.931115+00:00", "updated": "2026-04-22T13:30:17.931126+00:00", "vendors": []}