WordPress Plugin Vulnerabilities

Media Library Folders < 8.1.9 - Authenticated (Author+) Directory Traversal

Description

The Media Library Folders plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.1.8. This makes it possible for authenticated attackers, with author-level access and above, to read/access the contents of arbitrary files on the server, which can contain sensitive information.

Affects Plugins

Plugin icon
media-library-plus
Fixed in 8.1.9

References

CVE
CVE-2024-31287
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/4534efd4-0e6b-4784-8f81-4a643f657c66

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Majed Refaea
Verified
No
WPVDB ID
2efe1cde-5ebc-442d-a7a9-29a4ed6e3037

Timeline

Publicly Published
2024-04-05 (about 2 years ago)
Added
2024-04-11 (about 2 years ago)
Last Updated
2024-04-11 (about 2 years ago)

Other

Published
Title
Published
2022-05-16
Title
Herd Effects < 5.2.1 - Admin+ LFI
Published
2023-10-11
Title
AI ChatBot < 4.9.1 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
Published
2025-07-22
Title
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor < 1.27.9 - Authenticated (Contributor+) Path Traversal
Published
2014-08-01
Title
Payment Gateways Caller for WP e-Commerce 0.1.0 - load_merchant Parameter Traversal Local file Inclusion
Published
2025-10-24
Title
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings < 8.4.9 - Authenticated (Subscriber+) Arbitrary File Move