Authorization

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavefolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...

CVE-2023-0718

The CVE-2023-0718 entry relates to the Wicked Folders WordPress plugin. A missing capability check in the ajax_save_folder function (affected versions up to and including 2.18.16) allows authenticated users with subscriber-level permissions and above to perform administrator-level actions such as...

CVE-2023-0718 Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajaxsavefolder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this...