{"id":"CVE-2026-107787","aliases":["EUVD-2026-117356","GHSA-g4cm-95vw-hm27"],"status":"published","title":"CatFolders \u003c 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge","description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00133,"percentile":0.02892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-11-05T06:00:29Z","modified":"2026-11-06T12:06:47Z","products":[{"vendor":"catfolders","product":"catfolders"},{"vendor":"unknown","product":"catfolders"}],"references":[{"url":"https://wpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107787"},{"url":"https://wpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486"},{"url":"https://github.com/advisories/GHSA-g4cm-95vw-hm27"}],"sources":{"cve":[{"id":"CVE-2026-107787","title":"CatFolders \u003c 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge","description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","status":"published","published":"2026-11-05T06:00:29.98Z","modified":"2026-11-06T12:06:47.299Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-117356","description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","status":"published","published":"2026-11-05T06:00:29Z","modified":"2026-11-06T12:06:47Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-g4cm-95vw-hm27","title":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder...","description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","status":"published","published":"2026-11-05T06:34:37Z","modified":"2026-11-06T15:31:24Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-107787","description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","status":"published","published":"2026-11-05T06:17:07.46Z","modified":"2026-11-06T13:17:22.8Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-06T16:00:36.254659Z"}]}}