The Media Library Folders plugin for WordPress contains an insecure direct object reference flaw, a CWE-862 (Missing Authorization), that allows authenticated users with author or higher privileges to delete or rename any media attachment belonging to other users. The underlying delete_maxgalleria_media() and maxgalleria_rename_image() functions do not validate a user‑controlled key, so an attacker can target attachments owned by anyone, including administrators. In addition to removal, the rename operation deletes all postmeta associated with the attachment, resulting in loss of related metadata.

All releases of the MaxFoundry Media Library Folders plugin for WordPress up to and including version 8.3.6 are affected. No alternative vendors or products are mentioned in the advisory.

The CVSS v3 base score of 4.3 reflects a low‑to‑medium severity; the EPSS score is below 1 %, indicating a small likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a logged‑in user with author or higher role who can issue a crafted request to the affected endpoints with the attachment ID of another user. Based on the description, it is inferred that remote exploitation is not possible; the attack vector requires authenticated web requests within the WordPress installation.