CVE-2023-0720

The CVE-2023-0720 entry concerns the Wicked Folders WordPress plugin. A missing capability check in ajax_save_folder_order in versions up to and including 2.18.16 enables authorization bypass for authenticated users with subscriber-level or higher privileges, allowing actions intended for adminis...

WordPress Wicked Folders Plugin <= 2.18.16 is vulnerable to Broken Access Control

Software Wicked Folders Type Plugin Vulnerable versions = 2.18.16 Fixed in 2.18.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0720 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID a7a279fd02cf Credits Marco Wotschka Requir...