PT-2026-25528 · Wickedplugins · Wicked Folders – Folder Organizer For Pages

Youssef Elouaer · Publicado 2026-03-15 · Atualizado 2026-03-16 · CVE-2026-1883

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types versions prior to 4.1.1

Description The Wicked Folders plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in versions up to and including 4.1.0. This is due to a lack of validation on a user-controlled key within the delete folders() function. Authenticated attackers with Contributor-level access or higher can exploit this to delete folders created by other users. The delete folders() function is the component directly involved in this issue.

Recommendations Update Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types to version 4.1.1 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-1883

Produtos afetados

Wicked Folders – Folder Organizer For Pages

Referências · 4

• https://wordfence.com/threat-intel/vulnerabilities/id/5cec2c52-d780-4d94-a5b2-d3b405bce49c?source=cve · Nota
• https://t.me/CVEtracker/47408 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3473857/wicked-folders · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1883 · Nota de Segurança