Description
The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/f472ec7d-765c-4266-ab9c-e2d06703ebb4
Patch, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2651221
Scores
CVSS v3
8.8
EPSS
0.0152
EPSS Percentile
71.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
wickedplugins/wicked_folders
< 2.18.10
Published
Feb 01, 2022
Tracked Since
Feb 18, 2026