CVE-2023-0685

The Wicked Folders plugin for WordPress contains a cross-site request forgery vulnerability in versions 2.18.16 and earlier due to inadequate nonce validation in the ajax_unassign_folders function. An unauthenticated attacker could exploit this flaw by crafting a malicious request and convincing an administrator to interact with it, allowing the attacker to modify the plugin's folder structure without authorization. The vulnerability affects users running version 2.18.16 or below, with a fix available in version 2.18.17 and later.

Based on public CVE data (MITRE/NVD).