Security readout for executives and security teams
Plain-English summary
This issue lets any logged-in WordPress user, even a subscriber, use Wicked Folders functionality meant for administrators. The known impact is limited to modifying the plugin’s folder view state, not stealing data or taking over the site. It still matters where public registration or many low-trust accounts exist.
Executive priority
Treat as a medium-priority WordPress plugin hygiene issue. Prioritize remediation on externally reachable sites with many users or self-service registration. It is not described as site takeover, but weak authorization in WordPress plugins can create avoidable operational risk.
Technical view
Wicked Folders through 2.18.16 lacks an authorization capability check in ajax_save_state. Authenticated low-privilege users can invoke that AJAX handler and change folder structure view state. The CVSS 3.1 score is 5.4 with low complexity, required privileges, no user interaction, and limited integrity and availability impact.
Likely exposure
Exposure is limited to WordPress sites running Wicked Folders versions up to and including 2.18.16, especially sites with subscriber accounts, customer logins, memberships, or open registration. Sites without the plugin are not affected based on the provided sources.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Abuse requires an authenticated WordPress account with subscriber-level permissions or higher. Public exploit details are not needed to validate exposure.
Researcher notes
The core weakness is CWE-862: missing authorization. The provided evidence identifies ajax_save_state in Wicked Folders through 2.18.16 and a WordPress Trac changeset, but the bundle does not provide active exploitation evidence or a complete vendor advisory narrative.
Mitigation direction
- Inventory WordPress sites for Wicked Folders installations and versions.
- Update affected installations to a vendor-supported version newer than 2.18.16, if available.
- Check Wordfence and WordPress plugin guidance before relying on a specific fixed version.
- If updating cannot be confirmed, disable the plugin where business impact allows.
- Reduce low-trust WordPress accounts and disable open registration where unnecessary.
Validation and detection
- Confirm whether Wicked Folders is installed on each WordPress site.
- Record the installed plugin version and flag versions up to 2.18.16.
- Review the plugin code or vendor patch for a capability check in ajax_save_state.
- Verify low-privilege accounts cannot perform administrator-intended folder state changes.
- Review WordPress account registration settings and subscriber population.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-0711 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L2.82.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.phpCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2860994%40wicked-folders%2Ftrunk&old=2805161%40wicked-folders%2Ftrunk&sfp_email=&sfph_mail=CVE reference
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177CVE reference · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.