CVE-2023-0718

The Wicked Folders plugin for WordPress before version 2.18.17 contains an authorization bypass vulnerability in the ajax_save_folder function that lacks proper capability verification. Authenticated users with minimal subscriber-level access or higher can exploit this flaw to call the function and execute administrative actions, including altering the plugin's folder organization system. The vulnerability allows attackers with low-level credentials to perform operations that should be restricted to administrators only.

Based on public CVE data (MITRE/NVD).