CVE-2025-12640

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12640", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-03T18:46:34.428Z", "datePublished": "2026-01-08T02:21:16.994Z", "dateUpdated": "2026-04-08T17:14:52.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:52.734Z"}, "affected": [{"vendor": "premio", "product": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library."}], "title": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402986/folders/tags/3.1.6/includes/media.replace.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "timeline": [{"time": "2025-11-03T19:02:56.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-07T14:21:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T16:19:58.182067Z", "id": "CVE-2025-12640", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T16:20:05.877Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12640", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T16:19:58.182067Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T16:20:01.092Z"}}], "cna": {"title": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "premio", "product": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T19:02:56.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-07T14:21:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402986/folders/tags/3.1.6/includes/media.replace.php"}], "descriptions": [{"lang": "en", "value": "The Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:52.734Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12640", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:52.734Z", "dateReserved": "2025-11-03T18:46:34.428Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-08T02:21:16.994Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager", "vendor": "premio", "versions": [{"lessThanOrEqual": "3.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Replacement in all versions up to, and including, 3.1.5. This is due to missing object-level authorization checks in the handle_folders_file_upload() function. This makes it possible for authenticated attackers, with Author-level access and above, to replace arbitrary media files from the WordPress Media Library."}, {"lang": "es", "value": "El plugin Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager para WordPress es vulnerable a Reemplazo Arbitrario de Medios No Autorizado en todas las versiones hasta la 3.1.5, inclusive. Esto se debe a la falta de comprobaciones de autorizaci\u00f3n a nivel de objeto en la funci\u00f3n handle_folders_file_upload(). Esto hace posible que atacantes autenticados, con acceso de nivel Autor y superior, reemplacen archivos multimedia arbitrarios de la biblioteca de medios de WordPress."}], "id": "CVE-2025-12640", "lastModified": "2026-06-17T08:32:43.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12640", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T16:19:58.182067Z", "version": "2.0.3"}}]}, "published": "2026-01-08T03:15:42.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3402986/folders/tags/3.1.6/includes/media.replace.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:35:23.585089+00:00", "value": {"mitigation_remediation": ["Upgrade the Folders plugin to version 3.1.6 or later, which contains the missing authorization checks.", "If an upgrade is not immediately feasible, restrict or remove Author and higher level roles from users who do not require media upload capabilities, minimizing the window of opportunity for abuse.", "Regularly monitor the Media Library for unexpected file changes or replacements, and investigate any anomalies promptly."], "summary": {"action": "Apply patch", "impact": "Unauthorized arbitrary media replacement"}, "threat_synthesis": {"affected_systems": "The affected product is the Folders \u2013 Unlimited Folders to Organize Media Library plugin for WordPress. All released versions up to and including 3.1.5 are impacted. Any WordPress installation running those versions of the plugin with an authenticated user who has Author or higher role is susceptible.", "description_and_impact": "The vulnerability arises from a missing object\u2011level authorization check in the handle_folders_file_upload() function of the Folders WordPress plugin. It allows authenticated users who hold Author or higher roles to replace any media file in the WordPress Media Library, potentially modifying or deleting valuable content without the site owner's consent. This defect does not grant remote code execution or elevate privileges beyond the existing authenticated user.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, reflecting that the attack requires legitimate author credentials and does not compromise systems beyond the user's existing permissions. The EPSS score of less than 1% shows a low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the defect permits direct alteration of media files, it is a significant risk to the integrity and trustworthiness of the site\u2019s content. The likely attack vector involves a legitimate author account that has been compromised or misused to upload a malicious replacement file."}}}}, "created": "2026-01-08T09:47:46.596225+00:00", "updated": "2026-04-21T16:45:15.212355+00:00", "vendors": ["galdub", "galdub$PRODUCT$folders", "wordpress", "wordpress$PRODUCT$wordpress"]}