WordPress Plugin Vulnerabilities

CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge

Description

The plugin does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the plugin's user restriction setting.

Proof of Concept

Affects Plugins

Plugin icon
catfolders
Fixed in 2.5.7

References

CVE
CVE-2026-107787

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
3.1 (low)

Miscellaneous

Original Researcher
Akshat Parikh (SN1PER)
Submitter
Akshat Parikh (SN1PER)
Submitter website
https://akshatsecurity.com/
Verified
Yes
WPVDB ID
cc0fd80d-3fd0-489c-985f-33fcca429486

Timeline

Publicly Published
2026-11-03 (about 3 days ago)
Added
2026-11-03 (about 2 days ago)
Last Updated
2026-11-03 (about 2 days ago)

Other

Published
Title
Published
2025-07-14
Title
Alone – Charity Multipurpose Non-profit WordPress Theme < 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Published
2025-04-04
Title
SurveyJS < 1.12.57 - Missing Authorization
Published
2024-04-22
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.29 - Missing Authorization
Published
2026-10-26
Title
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
Published
2026-01-27
Title
HAPPY < 1.0.9 - Missing Authorization