What is the CVSS score of CVE-2026-1883?

CVE-2026-1883 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1883?

Organizations using for WordPress is vulnerable to Insecure Direct Object Reference in all should be aware of moderate risk from CVE-2026-1883, a IDOR vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-1883?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Insecure Direct Object Refere and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1883

EUVD-2026-12198 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-15 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 02:00 euvd

EUVD-2026-12198

Analysis Generated

Mar 15, 2026 - 02:00 vuln.today

CVE Published

Mar 15, 2026 - 01:19 nvd

MEDIUM 4.3

DescriptionCVE.org

The Wicked Folders - Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the delete_folders() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders created by other users.

AnalysisAI

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Wicked Folders plugin for WordPress (versions up to 4.1.0) within the delete_folders() function, allowing authenticated attackers with Contributor-level privileges to delete arbitrary folders created by other users due to missing validation on user-controlled folder identifiers. The vulnerability has a CVSS score of 4.3 (low-to-moderate severity) with a network attack vector requiring low privilege access and no user interaction. While the CVSS rating is moderate, the practical impact is data loss affecting legitimate users' organizational structures.

Technical ContextAI

The Wicked Folders plugin is a WordPress plugin that extends the WordPress content management system to provide folder organization capabilities for Pages, Posts, and Custom Post Types. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a classic IDOR pattern where the application fails to validate that the user making a request has authorization to perform actions on a specific resource. The delete_folders() function accepts a user-controlled folder identifier (likely a folder ID) as a parameter without checking whether the authenticated user is the owner or has explicit permission to delete that folder. This is a common authorization flaw in WordPress plugin development where developers assume that authentication alone is sufficient, failing to implement proper access control checks. The vulnerability affects all versions up to and including 4.1.0 of the plugin, suggesting the flaw has existed across multiple release cycles without remediation.

RemediationAI

The primary remediation is to upgrade the Wicked Folders plugin to a version newer than 4.1.0 as soon as the vendor releases a patched version that adds authorization checks to the delete_folders() function. Site administrators should check the WordPress Plugin Repository and the plugin vendor's website for version 4.1.1 or later and apply the update immediately. Until a patch is available, implement principle of least privilege by auditing all users with Contributor-level access or above and removing those accounts that do not require folder management permissions; alternatively, restrict Contributor-level access temporarily to trusted users only. If immediate patching is not feasible, consider temporarily disabling the plugin until updates are available, or use WordPress security plugins with capability filtering to prevent non-administrative users from triggering the delete_folders() function. Additionally, monitor and audit folder deletion logs through WordPress audit logging plugins to detect unauthorized folder deletions and investigate suspicious account activity.