CVE-2022-47142 MEDIUM

CVE-2022-47142: WordPress Mediamatic – Media Library Folders Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Plugincraft
Product Mediamatic – Media Library Folders
Weakness CWE-352 · CSRF
Published May 22, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Mediamatic – Media Library Folders versions up to 2.8.1 are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions within the plugin without the admin's knowledge or consent. The vulnerability requires user interaction but poses a risk to site integrity.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions in the plugin on behalf of a logged-in administrator without their consent.

Potential impact on your site

04Site Impact

An attacker could modify media library folder settings or perform other plugin actions if an admin visits a compromised page.

Conditions required to exploit

05Prerequisites

A logged-in site administrator must visit a malicious webpage controlled by the attacker.

Key dates

06Disclosure timeline

May 22, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability CVE-2026-57761 WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability CVE-2026-15988 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match CVE-2026-57635 WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-61956 WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability