---
id: CVE-2026-107787
title: >-
  CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction
  Disable via catf_run_merge
summary: >-
  The CatFolders  WordPress plugin before 2.5.7 does not have authorisation
  checks on a folder maintenance action, allowing users with a role as low as
  subscriber to reset the per-user ownership of every media folder and disable
  the CatFol…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: CatFolders
affected:
  - CatFolders < 2.5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T11:53:17.722816Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:06:47.299Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107787'
references:
  - url: 'https://wpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486/'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.02823
ingestedAt: '2026-11-05T21:36:00.791Z'
---

## Overview

The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.

## Affected

- `CatFolders < 2.5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.