CatFolders vulnerabilities

The CatFolders WordPress plugin before 2.5.7 does not have authorization checks on a folder maintenance action. This allows users with a role as low as Subscriber to reset the per-user ownership of every media folder and disable the plugin's user restriction setting.

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query. This allows authenticated users with upload capability (Author and above) to perform SQL injection attacks.

Missing Authorization vulnerability in CatFolders (WordPress plugin) in versions up to 2.5.3. Allows exploiting incorrectly configured access control security levels.