PT-2026-1699

🗓️ 08 Jan 2026 00:00:00Reported by Positive TechnologiesType

The Folders plugin up to version 3.1.5 allows authors to replace any media file due to missing object-level checks.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12640	8 Jan 202608:19	–	circl
CNNVD	WordPress plugin Folders 安全漏洞	8 Jan 202600:00	–	cnnvd
CVE	CVE-2025-12640	8 Jan 202602:21	–	cve
Cvelist	CVE-2025-12640 Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement	8 Jan 202602:21	–	cvelist
EUVD	EUVD-2026-1598	8 Jan 202602:21	–	euvd
NVD	CVE-2025-12640	8 Jan 202603:15	–	nvd
Patchstack	WordPress Folders plugin <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement vulnerability	7 Jan 202622:31	–	patchstack
RedhatCVE	CVE-2025-12640	9 Jan 202609:18	–	redhatcve
Vulnrichment	CVE-2025-12640 Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement	8 Jan 202602:21	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (January 5, 2026 to January 11, 2026)	15 Jan 202616:14	–	wordfence

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-12640
plugins	www.plugins.trac.wordpress.org/changeset/3402986/folders/tags/3.1.6/includes/media.replace.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2
twitter	www.twitter.com/CVEnew/status/2009149974282719398
t	www.t.me/cveNotify/148039
t	www.t.me/CVEtracker/41674
twitter	www.twitter.com/VulmonFeeds/status/2009121798563017040

08 Jan 2026 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.14.3

EPSS0.00048

SSVC