CVE-2026-107787
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The CatFolders WordPress plugin before 2.5.7 does not have authorization checks on a folder maintenance action. This allows users with a role as low as Subscriber to reset the per-user ownership of every media folder and disable the plugin's user restriction setting.
Risk Assessment
A low-privileged user can alter media folder ownership and weaken access controls, leading to integrity and confidentiality violations of files.
Recommendation
Update the CatFolders plugin to version 2.5.7 or later.
Other vulnerabilities in CatFolders
See all- CVE-2026-107786Medium
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query. This allows authenticated users with upload capability (Author and above) to perform SQL injection attacks.
- CVE-2025-66120Medium
Missing Authorization vulnerability in CatFolders (WordPress plugin) in versions up to 2.5.3. Allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS