{"id":"CVE-2026-107787","kind":"vulnerability","aliases":["CVE-2026-107787"],"related":[],"title":"CatFolders WordPress plugin: missing authorization lets subscribers reset folder ownership","description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","summary":"The CatFolders WordPress plugin before 2.5.7 has a folder maintenance action with no authorization check. Any logged-in user with the subscriber role can reset per-user ownership of every media folder and disable the plugin's user restriction setting.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["catfolders","runtime","wordpress"],"not_affected_if":["no-user-registration","plugin-not-installed","version-2.5.7-or-later"],"how_to_check":"- Check the installed CatFolders version in the WordPress admin plugins list or in `wp plugin get catfolders --field=version`\n- Confirm whether open user registration allows subscriber accounts on the site","fix":"- CatFolders `2.5.7` and later (the sources state the plugin is fixed before 2.5.7)","status":"open","published_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:14+00:00","updated_at":"2026-11-05T06:33:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T06:33:14Z","model":"claude-haiku-5-5","output":{"fix":"- CatFolders `2.5.7` and later (the sources state the plugin is fixed before 2.5.7)","reach":"network","title":"CatFolders WordPress plugin: missing authorization lets subscribers reset folder ownership","impact":"medium","summary":"The CatFolders WordPress plugin before 2.5.7 has a folder maintenance action with no authorization check. Any logged-in user with the subscriber role can reset per-user ownership of every media folder and disable the plugin's user restriction setting.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","catfolders"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Any logged-in subscriber can change folder ownership and disable restrictions","analyst_note":"","how_to_check":"- Check the installed CatFolders version in the WordPress admin plugins list or in `wp plugin get catfolders --field=version`\n- Confirm whether open user registration allows subscriber accounts on the site","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.5.7-or-later","no-user-registration"],"who_is_affected":"Only WordPress sites running the CatFolders plugin before 2.5.7 are exposed. Any account that can log in, including the lowest subscriber role, can reach the vulnerable action, so sites with open registration or many low-privilege users carry more risk. Sites without the plugin or already on 2.5.7 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4223,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107787':13A,16A '-2026':12A,15A '2.5.7':25B,67C,105C 'action':30B,77C 'allow':78C 'author':5A,33B 'authoris':71C 'catfold':1A,17B,21B,63C,101C 'check':34B,72C 'cve':11A,14A 'disabl':55B,99C 'everi':51B,95C 'folder':9A,28B,53B,75C,97C 'let':6A 'log':37B 'logged-in':36B 'low':84C 'mainten':29B,76C 'media':52B,96C 'miss':4A 'ownership':10A,49B,93C 'per':47B,91C 'per-us':46B,90C 'plugin':3A,23B,57B,65C,103C 'reset':8A,45B,88C 'restrict':60B,108C 'role':43B,82C 'runtim':18B 'set':61B,109C 'subscrib':7A,42B,86C 'user':39B,48B,59B,79C,92C,107C 'wordpress':2A,19B,22B,64C,102C","nicknames":[],"mitigations":[],"who_affected":"Only WordPress sites running the CatFolders plugin before 2.5.7 are exposed. Any account that can log in, including the lowest subscriber role, can reach the vulnerable action, so sites with open registration or many low-privilege users carry more risk. Sites without the plugin or already on 2.5.7 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["catfolders","medium","runtime","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107787","severity":null,"published_at":"2026-11-05T06:17:07+00:00","modified_at":"2026-11-05T06:17:07+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}