What the vulnerability does
01Description
The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the import-csv REST API endpoint in all versions up to, and including, 2.3.1. This is due to the endpoint using `upload_files` capability check (Author level) for a destructive operation that can delete all folders. This makes it possible for authenticated attackers, with Author-level access and above, to delete all folder organization data created by Administrators and other users.
Explanation of Vulnerability in Simple Terms
02Summary
MediaCommander versions up to 2.3.1 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can change or delete media, posts, or pages belonging to other users or restricted areas. The vulnerability requires a valid WordPress login but no special interaction from victims.
What an attacker can do
03Attacker Capabilities
Modify or delete media, posts, and pages belonging to other users or restricted sections.
Potential impact on your site
04Site Impact
Unauthorized content changes, deletions, or defacement by low-privilege users; potential data loss and site integrity compromise.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with at least Subscriber or Contributor role.
Key dates
06Disclosure timeline
December 13, 2025
CVE published
April 8, 2026
Record updated
