CVE-2023-0716

CVE-2023-0716 describes an authorization bypass vulnerability in the Wicked Folders plugin for WordPress, affecting versions up to and including 2.18.16. This flaw allows authenticated attackers with subscriber-level permissions or higher to modify the plugin's folder structure, an action typically reserved for administrators. With a CVSS score of 4.3 (Medium), the vulnerability is easily exploitable over the network with low complexity and no user interaction, potentially leading to unauthorized data modification. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.