PLUGIN SECURITY
Is Folders safe?
Create unlimited folders with the Folders WordPress plugin, organize & manage your Media Library files, Pages & Posts in folders 📁
What this plugin does
- Slug:
folders - Author: Premio
- 90000+ active installs
- 100/100 rating (1517 reviews on wordpress.org)
- 2207569 all-time downloads
- On WordPress.org since 2015-05-01
folderfoldersmedia librarypages foldersreplace media
Maintenance status
- Latest known version: 3.1.9
- Last updated: 2026-08-13 7:34am GMT
- Tested up to WordPress: 7.1
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
6 known CVEs on file for Folders. Reported between 2023 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-12640 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 3.1.6 | Missing Authorization | Medium 4.3 | < 3.1.6 | 3.1.6 | 2026-01-07 | ✓ fixed in latest |
| CVE-2025-12971 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 3.1.6 | Incorrect Authorization | Medium 4.3 | < 3.1.6 | 3.1.6 | 2025-11-26 | ✓ fixed in latest |
| CVE-2024-7317 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 3.0.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.0.4 | 3.0.4 | 2024-08-05 | ✓ fixed in latest |
| CVE-2024-2023 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 3.0.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.3 | < 3.0.1 | 3.0.1 | 2024-06-13 | ✓ fixed in latest |
| CVE-2024-3868 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 3.0.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.0.3 | 3.0.3 | 2024-05-03 | ✓ fixed in latest |
| CVE-2023-40204 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 2.9.3 | Unrestricted Upload of File with Dangerous Type | Critical 9.1 | < 2.9.3 | 2.9.3 | 2023-08-28 | ✓ fixed in latest |
| — | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 2.9.3 | — | Unknown | < 2.9.3 | 2.9.3 | 2023-08-25 | ✓ fixed in latest |
| — | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager [folders] < 2.9.3 | — | Unknown | < 2.9.3 | 2.9.3 | — | ✓ fixed in latest |
+ 1 more known vulnerability
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Folders < 2.9.3 - Authenticated (Author+) Arbitrary File Upload | — | Unknown | < 2.9.3 | 2.9.3 | — | ✓ fixed in latest |
How to fix it
Keep Folders updated — 3.1.9 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types — 20000+ active installs — 98/100 (56) — max PHP 8.4
- CatFolders – WordPress Media Library Folders & Categories — 6000+ active installs — 88/100 (21) — max PHP <8.0
- WP Media folders — 2000+ active installs — 70/100 (15) — max PHP 8.4
- Organize Media Folder — 2000+ active installs — 82/100 (16) — max PHP 8.4
- BuddyDrive — 1000+ active installs — 86/100 (47)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.