Authorization Bypass Vulnerability in Wicked Folders for WordPress

CVE-2023-0713

Summary

The Wicked Folders plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level permissions or higher to bypass normal authorization checks. This is due to a missing capability verification in the ajax_add_folder function. As a result, attackers can execute administrative actions, such as altering the folder structure within the plugin. It is crucial for users of this plugin to update to the latest version to mitigate any potential security risks.

References