Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion
mediumThe Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generate_json_page function in all versions up to, and including, 1.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrar...
- CVSS:
- 6.5
- Affected:
- up to 1.22
- Fixed in:
- 1.23
- Disclosed:
- Mar 5, 2025