CVE-2026-107787 · Runtime
NO FIX YET · SEE WHAT TO DO
The CatFolders WordPress plugin before 2.5.7 has a folder maintenance action with no authorization check. Any logged-in user with the subscriber role can reset per-user ownership of every media folder and disable the plugin's user restriction setting.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only WordPress sites running the CatFolders plugin before 2.5.7 are exposed. Any account that can log in, including the lowest subscriber role, can reach the vulnerable action, so sites with open registration or many low-privilege users carry more risk. Sites without the plugin or already on 2.5.7 or later are not affected.
Not affected if no-user-registration, plugin-not-installed, version-2.5.7-or-later
Who cares catfolders, wordpress
wp plugin get catfolders --field=version2.5.7 and later (the sources state the plugin is fixed before 2.5.7)The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.