Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress has a vulnerability known as Insecure Direct Object Reference (IDOR) in all versions up to and including 4.1.0. This vulnerability exists in the delete_folders() function because it lacks proper validation on a user-controlled key.

As a result, authenticated users with Contributor-level access or higher can exploit this flaw to delete arbitrary folders created by other users, bypassing intended permission restrictions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with Contributor-level access or above to delete folders created by other users within the Wicked Folders plugin. This can lead to unauthorized data loss or disruption of content organization within a WordPress site.

Since the vulnerability does not affect confidentiality or availability directly (CVSS Impact: No Confidentiality or Availability impact, only Integrity is impacted), the main impact is the unauthorized modification (deletion) of folder data, which could disrupt workflows or content management.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the Wicked Folders plugin version is 4.1.0 or earlier, as these versions lack proper permission checks in the delete_folders() function.

Since the vulnerability allows authenticated users with Contributor-level access or higher to delete arbitrary folders, monitoring for unexpected folder deletion events by such users can help detect exploitation attempts.

There are no specific network commands provided in the resources, but you can check the installed plugin version via WordPress CLI:

• wp plugin list | grep wicked-folders

Additionally, reviewing WordPress logs or database entries for folder deletions by users with Contributor or higher roles may help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Wicked Folders plugin to version 4.1.1 or later, which includes enhanced permission checks preventing unauthorized folder deletions.

This update enforces proper capability checks such as delete_term permissions on folder taxonomy terms, blocking contributors from deleting folders they do not own.

If updating immediately is not possible, restrict Contributor-level users from accessing folder deletion features or temporarily downgrade their permissions until the patch can be applied.

Useful 0 Not Useful 0