Authorization Bypass Vulnerability in Wicked Folders Plugin for WordPress

CVE-2023-0718

Summary

The Wicked Folders plugin for WordPress suffers from an authorization bypass issue due to the absence of a proper capability check in the ajax_save_folder function. This vulnerability allows authenticated attackers, including those with minimal subscriber-level permissions, to exploit this flaw. By doing so, they can execute privileged actions intended for administrators, such as altering the folder structure managed by the plugin, which can lead to unauthorized access and potential data manipulation.

References