CVE-2023-0719: 
WordPress vulnerability analysis and mitigation

The Wicked Folders plugin for WordPress (versions <= 2.18.16) was found to contain a vulnerability identified as CVE-2023-0719. The security flaw was discovered by Marco Wotschka from Wordfence and was publicly disclosed on February 7, 2023. The vulnerability stems from a missing capability check on the ajaxsavesort_order functionality (Wordfence Intel).

The vulnerability is classified as an authorization bypass issue with a CVSS score of 5.4 (Medium). The security flaw exists in the ajaxsavesort_order function where the plugin fails to implement proper authorization checks, potentially allowing unauthorized access to certain functionality (WPScan).

The vulnerability could allow any authenticated users, including those with low-privilege roles such as subscribers, to perform unauthorized actions related to folder structure management, including moving, deleting, and creating folders (WPScan).

The vulnerability was patched in version 2.18.17 of the Wicked Folders plugin. Site administrators are strongly advised to update to this version or later to protect against potential exploitation (WPScan).