CVE-2023-0729

The Wicked Folders plugin through version 2.18.16 contains a CSRF vulnerability in the ajax_save_sort_order function caused by inadequate nonce verification. An unauthenticated attacker could exploit this flaw by crafting a malicious request that, when clicked by an administrator, would allow the attacker to modify the plugin's folder organization without proper authorization. This vulnerability impacts the integrity of folder structures on affected WordPress installations.

Based on public CVE data (MITRE/NVD).