Vulnerabilities / Wicked Folders
Wicked Folders vulnerabilities
Advisories WPSec published for Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types. Other sources may list more. Its attack surface: Wicked Folders on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-03 | WPSEC-2026-0407 | Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference to Screen State Overwrite via REST API | Medium 4.3 | 4.2.0 |
| 2026-10-03 | WPSEC-2026-0406 | Wicked Folders <= 4.1.3 - Authenticated (Contributor+) Missing Authorization to Folder Assignment of Arbitrary Posts via REST API | Medium 4.3 | 4.2.0 |
License: CC BY 4.0