title: Media from FTP < 11.17 - Author+ Arbitrary File Access
description: The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.
problem types: CWE-863 Incorrect Authorization
affected:
{
vendor: Unknown
product: Media from FTP
versions:
status: affected, versionType: custom, version: 0, lessThan: 11.17
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}