Now officially on WordPress.org

CVE Database / CVE-2023-0716

CVE · Medium

CVE-2023-0716 — Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types [wicked-folders] < 2.18.17

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2023-0716 Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types [wicked-folders] < 2.18.17 Missing Authorization Medium 4.3 < 2.18.17 2.18.17 2023-02-07 —

CVE-2023-0716

The Wicked Folders plugin contains an authorization bypass vulnerability in its ajax_edit_folder function affecting versions 2.18.16 and earlier. Authenticated users with subscriber-level access or higher can invoke this function without proper permission validation, allowing them to modify folder structures that should only be editable by administrators. The vulnerability stems from missing capability checks on the vulnerable function. Users should upgrade to version 2.18.17 or later to resolve this issue.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings