CVE-2025-12640

🗓️ 08 Jan 2026 02:21:16Reported by WordfenceType

The Folders plugin lets Author or higher replace any media file due to missing authorization checks.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12640	8 Jan 202608:19	–	circl
CNNVD	WordPress plugin Folders 安全漏洞	8 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-12640 Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement	8 Jan 202602:21	–	cvelist
EUVD	EUVD-2026-1598	8 Jan 202602:21	–	euvd
NVD	CVE-2025-12640	8 Jan 202603:15	–	nvd
Patchstack	WordPress Folders plugin <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement vulnerability	7 Jan 202622:31	–	patchstack
Positive Technologies	PT-2026-1699	8 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-12640	9 Jan 202609:18	–	redhatcve
Vulnrichment	CVE-2025-12640 Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement	8 Jan 202602:21	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (January 5, 2026 to January 11, 2026)	15 Jan 202616:14	–	wordfence

Vulners

Node

premio folders_unlimited_folders_to_organize_media_library_folder,_pages,_posts,_file_managerRange≤3.1.5wordpress

[
  {
    "vendor": "premio",
    "product": "Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.1.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2
plugins	www.plugins.trac.wordpress.org/changeset/3402986/folders/tags/3.1.6/includes/media.replace.php

15 Apr 2026 00:35Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.14.3

EPSS0.00048

SSVC

CWE-862