CVE-2023-0711: 
WordPress vulnerability analysis and mitigation

The Wicked Folders plugin for WordPress contains a vulnerability (CVE-2023-0711) related to authorization bypass in versions up to and including 2.18.16. The vulnerability was discovered and disclosed on February 7, 2023, affecting the ajax_save_state function in the plugin (NVD).

The vulnerability stems from a missing capability check in the ajax_save_state function within the plugin. This security flaw allows authenticated users with subscriber-level permissions or higher to invoke functions intended only for administrators. The vulnerability has received a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, while Wordfence assessed it with a slightly higher score of 5.4 (NVD).

The vulnerability enables authenticated attackers with subscriber-level permissions to modify the view state of the folder structure maintained by the plugin, potentially disrupting the organizational structure intended by administrators (NVD).

Users should upgrade to version 2.18.17 or later of the Wicked Folders plugin, which includes the necessary security fixes to address this vulnerability (Wordfence).