The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress suffers from an Insecure Direct Object Reference in the delete_folders() function due to missing validation on a user-controlled parameter. This flaw allows an authenticated user with Contributor-level access or higher to delete any folder created by another user, effectively erasing user content and harming data integrity and availability. The flaw is classified as CWE‑639 (Indirect Control Flow Transfer).

This vulnerability affects all installations of the Wicked Folders plugin for WordPress with version 4.1.0 or earlier. The affected vendor is wickedplugins, which distributes the organized page, post, and custom post type folders within WordPress sites.

The CVSS v3.1 score of 4.3 indicates moderate risk, and the EPSS score of less than 1 % suggests that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Attackers must authenticate to the site and possess a Wordpress role equal to or higher than Contributor to exploit the flaw, making it an authenticated, privilege‑escalated vulnerability rather than a remote code execution. Given the limited exploitation probability, but potential for data loss, administrators should consider this a risk requiring timely patching.