CVE-2026-107787: CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge

Q: Who can exploit this issue?

Any authenticated WordPress user with a role as low as Subscriber can exploit the affected folder maintenance action. An attacker therefore needs only a valid low-privilege account, not administrative access.

Q: What is the impact of successful exploitation?

An attacker can reset the per-user ownership of every media folder and disable the plugin's user restriction setting. This can undermine folder-level access separation within CatFolders.

Q: Are sites using the default configuration affected?

The issue affects CatFolders versions before 2.5.7 because the relevant maintenance action lacks authorization checks. The provided information does not state that a particular non-default configuration is required.

Q: How can I determine whether my site is vulnerable?

Check the installed CatFolders version. Versions earlier than 2.5.7 are affected; the issue was fixed in version 2.5.7.

Published Nov 5, 2026

Updated

The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CatFolders WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.5.7

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with a role as low as Subscriber can exploit the affected folder maintenance action. An attacker therefore needs only a valid low-privilege account, not administrative access.

What is the impact of successful exploitation?

An attacker can reset the per-user ownership of every media folder and disable the plugin's user restriction setting. This can undermine folder-level access separation within CatFolders.

Are sites using the default configuration affected?

The issue affects CatFolders versions before 2.5.7 because the relevant maintenance action lacks authorization checks. The provided information does not state that a particular non-default configuration is required.

How can I determine whether my site is vulnerable?

Check the installed CatFolders version. Versions earlier than 2.5.7 are affected; the issue was fixed in version 2.5.7.

CVE-2026-107787: CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Are sites using the default configuration affected?

How can I determine whether my site is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Are sites using the default configuration affected?

How can I determine whether my site is vulnerable?