CVE-2023-0725

The Wicked Folders plugin for WordPress before version 2.18.17 contains a cross-site request forgery vulnerability in the ajax_clone_folder function due to inadequate nonce verification. An unauthenticated attacker can exploit this flaw by crafting a malicious request that, when clicked by an administrator, allows the attacker to modify the plugin's folder structure without proper authorization. The vulnerability requires social engineering to trick an admin into interacting with the forged request.

Based on public CVE data (MITRE/NVD).