CVE-2025-12971

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12971", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-10T17:57:13.316Z", "datePublished": "2025-11-27T12:31:00.809Z", "dateUpdated": "2026-04-08T17:32:54.408Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:54.408Z"}, "affected": [{"vendor": "premio", "product": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders."}], "title": "Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3845071-8419-4bb2-b22d-f9ae22fb7d6a?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-12971/"}, {"url": "https://plugins.trac.wordpress.org/browser/folders/trunk/includes/folders.class.php#L3291"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402986/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-11-10T18:16:59.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-26T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T21:21:12.369911Z", "id": "CVE-2025-12971", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T21:21:20.770Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12971", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T21:21:12.369911Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T21:21:15.829Z"}}], "cna": {"title": "Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "premio", "product": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T18:16:59.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-26T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3845071-8419-4bb2-b22d-f9ae22fb7d6a?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-12971/"}, {"url": "https://plugins.trac.wordpress.org/browser/folders/trunk/includes/folders.class.php#L3291"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402986/"}], "descriptions": [{"lang": "en", "value": "The Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:54.408Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12971", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:54.408Z", "dateReserved": "2025-11-10T17:57:13.316Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-27T12:31:00.809Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager", "vendor": "premio", "versions": [{"lessThanOrEqual": "3.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders."}, {"lang": "es", "value": "El plugin The Folders - Carpetas Ilimitadas para Organizar Carpetas de la Biblioteca de Medios, P\u00e1ginas, Entradas, Gestor de Archivos para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una verificaci\u00f3n de capacidad mal configurada en la funci\u00f3n 'wcp_change_post_folder' en todas las versiones hasta la 3.1.5, inclusive. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, mover contenidos de carpeta arbitrarios a carpetas arbitrarias."}], "id": "CVE-2025-12971", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12971", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T21:21:12.369911Z", "version": "2.0.3"}}]}, "published": "2025-11-27T13:15:58.547", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/folders/trunk/includes/folders.class.php#L3291"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3402986/"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-12971/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3845071-8419-4bb2-b22d-f9ae22fb7d6a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:14:04.245070+00:00", "value": {"mitigation_remediation": ["Upgrade the Premio Folders plugin to version 3.1.6 or later, which removes the incorrect capability check.", "If an upgrade is not immediately possible, disable or delete the plugin until a patch can be applied to eliminate exposed functionality.", "Revoke Contributor or higher roles from individuals who do not require that level of access and audit user permissions to ensure least-privilege is enforced."], "summary": {"action": "Apply patch", "impact": "Unauthorized content manipulation"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Premio Folders plugin, versions up to and including 3.1.5. The issue is present in every release up to that version, regardless of minor patch level.", "description_and_impact": "The plugin contains a misconfigured capability check in the wcp_change_post_folder function that allows authenticated users with Contributor-level privileges or higher to move any folder content to any other folder. This flaw gives attackers the ability to reorganize, hide, or replace content within the media library, pages, or posts, potentially leading to defacement or loss of data integrity. The vulnerability stems from an access control weakness (CWE-863).", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. The EPSS score is under 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need to be authenticated as a Contributor or higher role, so the exploit requires legitimate access to the WordPress administration console."}}}}, "created": "2025-11-28T08:51:25.210106+00:00", "updated": "2026-04-21T01:15:20.138116+00:00", "vendors": ["galdub", "galdub$PRODUCT$folders", "wordpress", "wordpress$PRODUCT$wordpress"]}