CVE-2026-107787: low-severity vulnerability in CatFolders
CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 3.1epss 0.1%
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · CatFolderspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — CatFolders
In the same product, most dangerous first.