CVE-2026-2312: 
WordPress vulnerability analysis and mitigation

CVE-2026-2312 is an Insecure Direct Object Reference (IDOR) vulnerability in the Media Library Folders plugin for WordPress, affecting all versions up to and including 8.3.6. The flaw exists in the delete_maxgalleria_media() and maxgalleria_rename_image() functions, which fail to validate user-controlled keys before performing privileged operations. Authenticated attackers with Author-level access or above can delete or rename media attachments owned by other users, including administrators, and the rename flow additionally deletes all postmeta for the targeted attachment, causing data loss. It was published on February 14, 2026, with a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, CIRCL).

The root cause is classified as CWE-862 (Missing Authorization). The vulnerable functions delete_maxgalleria_media() and maxgalleria_rename_image() accept user-supplied attachment IDs without verifying that the requesting user owns or has permission to modify the referenced media object. This allows any authenticated user with at least Author-level privileges to supply an arbitrary attachment ID belonging to another user — including an administrator — and trigger deletion or renaming of that asset over the network with no user interaction required. The rename operation has the additional side effect of purging all associated postmeta records for the targeted attachment, compounding the integrity impact (Red Hat CVE, CIRCL).

Successful exploitation allows an authenticated attacker to delete or rename media attachments belonging to any other WordPress user, including site administrators, resulting in unauthorized modification and potential permanent loss of media content and associated metadata. The deletion of postmeta records during the rename flow can cause cascading data loss affecting page layouts, SEO metadata, and other content that references the targeted attachment. While confidentiality is not directly impacted, the integrity and availability of site content can be significantly degraded, particularly if an attacker systematically targets critical media assets (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires authentication at the Author level or above, which limits the attack surface to users with existing accounts on the target WordPress site. The EPSS score is approximately 0.026% (0.000260), indicating a low probability of exploitation in the near term. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE, CIRCL).

1. Reconnaissance: Identify a WordPress site running the Media Library Folders plugin (maxfoundry) at version 8.3.6 or earlier. This can be done by inspecting plugin directories or JavaScript/CSS asset paths that reference the plugin name.
2. Obtain authenticated access: Acquire or register an account with at least Author-level privileges on the target WordPress site.
3. Enumerate attachment IDs: Use the WordPress REST API or standard media library queries to enumerate attachment post IDs belonging to other users, including administrators (e.g., GET /wp-json/wp/v2/media).
4. Trigger unauthorized deletion: Send a crafted request to the delete_maxgalleria_media() function supplying a target attachment ID owned by another user, bypassing ownership validation to delete the asset.
5. Trigger unauthorized rename and data loss: Send a crafted request to maxgalleria_rename_image() with a target attachment ID, causing the plugin to rename the attachment and delete all associated postmeta records for that attachment, resulting in data loss (Red Hat CVE).

• Logs: WordPress access logs showing POST requests to admin-ajax.php or plugin-specific endpoints with attachment IDs not owned by the authenticated user; repeated requests targeting multiple different attachment IDs in a short timeframe.
• File System: Media files in the WordPress uploads directory that have been unexpectedly renamed or are missing without corresponding admin activity in the audit log.
• Database: Sudden absence of postmeta records for specific attachment post IDs; wp_postmeta entries deleted for attachments not recently modified by their owners.
• Process/Behavior: Author-level user accounts performing media management actions on attachments they did not upload, visible in WordPress activity or audit log plugins if installed.

Users should update the Media Library Folders plugin (by MaxFoundry) to a version beyond 8.3.6 that includes proper authorization checks in the delete_maxgalleria_media() and maxgalleria_rename_image() functions. As an interim workaround, site administrators should restrict Author-level account creation to trusted users only and review existing Author accounts for legitimacy. Enabling a WordPress security or audit logging plugin can help detect unauthorized media manipulation attempts while a patch is applied (Red Hat CVE).

Coverage of CVE-2026-2312 has been limited to automated vulnerability tracking platforms and aggregators such as Vulners, VulDB, CVEFeed, and CIRCL, with no notable independent researcher commentary or significant social media discussion identified. The Spanish national CERT (INCIBE-CERT) published an early alert for the vulnerability (INCIBE-CERT). No major vendor statements beyond the Red Hat CVE advisory page have been observed.