The Folderly plugin for WordPress has a weakness in its REST API endpoint that allows the removal of all stored terms and categories. The flaw lies in an inadequate capability check, meaning that any authenticated user with Author or higher privileges can invoke the endpoint and erase critical data. This leads to a loss of content and potentially critical configuration data, impacting the integrity of the site.

All installations of the Folderly plugin with version 0.3 or earlier, running on WordPress environments, are affected. The vulnerability targets the /wp-json/folderly/v1/config/clear-all-data API route exposed by the plugin.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog. An attacker must first be authenticated as an Author or higher; once authenticated, the endpoint can be called to wipe data. There are no known public exploits, but the flaw can be leveraged in environments with permissive role assignments.