CVE-2023-0726

CVE-2023-0726 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Wicked Folders plugin for WordPress, affecting versions up to and including 2.18.16. This flaw stems from insufficient nonce validation in the ajax_edit_folder function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized modifications of the plugin's folder structure. The vulnerability has a CVSS score of 4.3 (Medium) with a network attack vector and low attack complexity, requiring user interaction but resulting in only low integrity impact. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.