CVE-2026-107787

The CatFolders WordPress plugin (versions before 2.5.7 ) is vulnerable to an authorization bypass. The plugin lacks proper permission checks on a folder maintenance action, specifically involving the catf_run_merge function. This allows users with privileges as low as subscriber to reset the per-...