PT-2026-137398
CVE-2026-107787
·
Published
2026-11-05
·
Updated
2026-11-05
Description by
CVSS 3.1
3.1
LowMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾