The MediaCommander plugin allows authenticated users who have Author privileges or higher to delete all media folder organization data via the import-csv REST API endpoint. This occurs because the endpoint performs the deletion with an upload_files capability check, which is insufficient for a destructive operation. As a result, an attacker can erase the folder structure set up by administrators and other users, causing loss of organization, potential disruption to media management, and administrative overhead.

All installations of the MediaCommander – Bring Folders to Media, Posts, and Pages plugin built by yalogica, currently affected by versions through 2.3.1 inclusive. Any site running one of these versions is at risk.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, while the EPSS score of < 1% suggests a very low exploitation probability in the general population. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the authenticated REST API endpoint import-csv; an attacker must first obtain Author or higher credentials to exploit the missing capability check. If successful, the attacker can delete all folder organization data, but cannot achieve further privilege escalation or code execution solely through this flaw.