{"id":"CVE-2026-107787","title":"CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge","summary":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFol…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"adp","cwe":["CWE-862"],"product":"CatFolders","affected":["CatFolders < 2.5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T11:53:17.722816Z"},"published":"2026-11-05","updated":"2026-11-06","sourceUpdated":"2026-11-06T12:06:47.299Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107787","references":[{"url":"https://wpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486/"}],"tags":["cve.org"],"epss":0.00132,"epssPercentile":0.02823,"ingestedAt":"2026-11-05T21:36:00.791Z","slug":"CVE-2026-107787","body":"## Overview\n\nThe CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.\n\n## Affected\n\n- `CatFolders < 2.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":235064,"id":"CVE-2026-107787","ts":1793969518724,"field":"cvss","old":null,"new":"3.1"},{"seq":235063,"id":"CVE-2026-107787","ts":1793969518724,"field":"severity","old":"none","new":"low"}]}