CVE-2026-24569: 
WordPress vulnerability analysis and mitigation

CVE-2026-24569 is a Missing Authorization (Broken Access Control) vulnerability in the "Media Library File Size" WordPress plugin by Sully, affecting all versions up to and including 1.6.7. The vulnerability allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. It was reported by researcher Nabil Irawan on December 22, 2025, and published by Patchstack on January 23, 2026. The CVSS v3.1 base score is 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. Specifically, a function within the plugin lacks a proper authorization, authentication, or nonce token check, allowing a low-privileged subscriber-level user to perform actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit remotely (Patchstack).

Successful exploitation allows a low-privileged authenticated user (e.g., a Subscriber) to perform unauthorized actions within the WordPress media library that should be restricted to higher-privileged users. Based on the updated CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the primary impact is on integrity — an attacker could potentially modify or manipulate media library file size data or related settings without authorization. Confidentiality and availability are not directly impacted, and the scope is limited to the affected WordPress installation (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack notes the vulnerability has low priority and is "unlikely to be exploited," though it acknowledges that broken access control vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Media Library File Size plugin version <= 1.6.7 using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/media-library-file-size/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for a Subscriber-level account on the target WordPress site (e.g., via open registration if enabled).
3. Identify unprotected endpoint: Locate the plugin function or REST API/admin-ajax endpoint that lacks proper authorization checks — this would be the action responsible for media library file size operations.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with Subscriber-level session cookies or nonce) directly to the unprotected endpoint, bypassing the intended access control restrictions.
5. Achieve unauthorized action: Successfully perform the privileged action (e.g., modifying media library settings or data) that should be restricted to Editor or Administrator roles (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the media-library-file-size plugin from low-privileged user accounts.
• Logs: Unusual activity in WordPress audit logs where Subscriber-level users are performing media library administrative actions.
• File System: Presence of plugin version <= 1.6.7 at /wp-content/plugins/media-library-file-size/ — confirm version via readme.txt or plugin header.
• Network: Repeated or scripted requests to plugin-specific endpoints from the same IP address, potentially indicating automated scanning or exploitation attempts.

The vendor has released version 1.6.8 of the Media Library File Size plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.6.8 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or removing Subscriber-level accounts can reduce the attack surface (Patchstack).