Authorization Bypass in Wicked Folders Plugin for WordPress

CVE-2023-0711

What is CVE-2023-0711?

The Wicked Folders plugin for WordPress contains a significant security flaw that allows authenticated users, including those with only subscriber-level permissions, to bypass authorization mechanisms. This vulnerability arises from the absence of a capability check in the ajax_save_state function, which can be exploited to perform administrative actions such as altering the folder structure within the plugin. This compromise can lead to unauthorized access and manipulation of folder visibility settings, posing a serious risk to the integrity of website management for users relying on this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References