Vulnerabilities / Wicked Folders / WPSEC-2026-0407
Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Screen State Overwrite via REST API
Medium 4.3
CWE-639Fixed in 4.2.0
- ID
- WPSEC-2026-0407
- Plugin
- Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types (wicked-folders)
- Affected
- from 3.0.0 before 4.2.0
- Remediation
- Update to 4.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Wicked Folders on WPSec AttackSurface
- Fix released
- Published
Description
The Wicked Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 3.0.0 up to, and including, 4.1.3 via the screen state REST API endpoint due to the target user ID being taken from the user-controlled 'userId' value in the request body. This makes it possible for authenticated attackers, with Contributor-level access and above, to overwrite the folder pane state (such as the selected folder, expanded folders and pane visibility) stored in other users' user meta.
References
- https://wpsec.com/vuln/WPSEC-2026-0407/
- https://plugins.svn.wordpress.org/wicked-folders/tags/4.2.0/
- https://wordpress.org/plugins/wicked-folders/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS