Authorization Bypass in CatFolders WordPress Plugin

Executive Summary

CVE-2026-107787 is a vulnerability in the CatFolders WordPress plugin versions before 2.5.7. It allows users with a subscriber role to reset ownership of all media folders and disable the plugin's user restriction settings due to missing authorization checks on a folder maintenance action.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the CatFolders WordPress plugin. If it is below 2.5.7, the system is vulnerable. Logs may show unauthorized actions by low-privilege users affecting media folder ownership or plugin settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker with subscriber-level access could take control of media folders, bypass user restrictions, and potentially disrupt the plugin's functionality. This could lead to unauthorized access to sensitive files or data stored in those folders.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Unauthorized access may result in data breaches and non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the CatFolders plugin to version 2.5.7 or later immediately. Review user roles and permissions to ensure no unauthorized changes occurred. Monitor for suspicious activity in media folder ownership and plugin settings.

Useful 0 Not Useful 0