What’s Vulnerable › Vulnerabilities

CVE-2025-12038: Folderly <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-01 · updated 2026-10-18
• Weakness: CWE-863

Description

The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config/clear-all-data REST API endpoint in all versions up to, and including, 0.3. This makes it possible for authenticated attackers, with Author-level access and above, to clear all data like terms and categories.

Affected products

• wpfolderly Folderly: through 0.3

References

• https://plugins.trac.wordpress.org/changeset/3384176/folderly/trunk/includes/Rest#file0
• https://www.wordfence.com/threat-intel/vulnerabilities/id/81d43850-c6aa-4340-a0e0-41e04e958848?source=cve

Get alerted when CVE-2025-12038 or the next vulnerability affects your stack