CVE-2025-66120
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Missing Authorization vulnerability in CatFolders (WordPress plugin) in versions up to 2.5.3. Allows exploiting incorrectly configured access control security levels.
Risk Assessment
Risk includes the possibility of unauthorized access to functions or data, potentially leading to integrity and confidentiality breaches.
Recommendation
Update CatFolders to a patched version. Review permission configuration and restrict access to sensitive functions.
Other vulnerabilities in CatFolders
See all- CVE-2026-107787Low
The CatFolders WordPress plugin before 2.5.7 does not have authorization checks on a folder maintenance action. This allows users with a role as low as Subscriber to reset the per-user ownership of every media folder and disable the plugin's user restriction setting.
- CVE-2026-107786Medium
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query. This allows authenticated users with upload capability (Author and above) to perform SQL injection attacks.
Original NVD description (English source)
Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CatFolders: from n/a through <= 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS