Authorization Bypass Vulnerability in Wicked Folders for WordPress

CVE-2023-0720

Summary

The Wicked Folders plugin for WordPress has a security flaw that could allow authenticated attackers to bypass authorization checks. Specifically, this vulnerability arises from a missing capability validation in the 'ajax_save_folder_order' function. As a result, users with subscriber-level access and higher can execute administrative actions, such as altering the folder organization within the plugin. This could potentially jeopardize the integrity and structure of folder contents, leading to unauthorized modifications.

References