CVE-2023-0730

The Wicked Folders plugin through version 2.18.16 contains a Cross-Site Request Forgery vulnerability in the ajax_save_folder_order function that lacks proper nonce verification. An attacker can exploit this flaw by crafting a malicious request that, if clicked by an administrator, allows unauthorized modification of the plugin's folder organization structure. The vulnerability requires social engineering to trick an admin into clicking a link but can result in changes to the site's folder hierarchy without legitimate authorization.

Based on public CVE data (MITRE/NVD).