Folderly WordPress Plugin Unauthorized Data Modification Vulnerability

A vulnerability exists in the Folderly plugin for WordPress, allowing unauthorized data modification. This issue arises from an inadequate capability check on the '/wp-json/folderly/v1/config/clear-all-data' REST API endpoint, affecting all versions up to and including 0.3. The flaw enables authenticated attackers with Author-level access or higher to delete all data, including terms and categories.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of terms and categories by authenticated users with Author-level access or higher.

Remediation

Users can update to version 0.3.1 or a newer patched version to address this vulnerability.