Medium severity5.4NVD Advisory· Published Feb 8, 2023· Updated Apr 8, 2026
CVE-2023-0711
CVE-2023-0711
Description
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the view state of the folder structure maintained by the plugin.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:wickedplugins:wicked_folders:*:*:*:*:*:wordpress:*:*Range: <=2.18.16
- Range: <=2.18.16
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.phpnvdRelease NotesThird Party Advisory
- plugins.trac.wordpress.org/changesetnvdThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177nvdThird Party Advisory
- www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177nvd
News mentions
0No linked articles in our index yet.