Wicked Folders WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Arbitrary Folder Deletion

A vulnerability exists in the Wicked Folders WordPress plugin, specifically in versions up to and including 4.1.0. The issue arises from an Insecure Direct Object Reference (IDOR) in the delete_folders() function, where user-controlled keys are not properly validated. This flaw enables authenticated attackers with Contributor-level access or higher to delete folders created by other users.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of folders, potentially leading to data loss for users whose folders are deleted.

Remediation

Users are advised to update the Wicked Folders WordPress plugin to version 4.1.1 or a later patched version.