{"affected":[{"defaultStatus":"unaffected","product":"CatFolders","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.5.7","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-107787","cwes":["CWE-862"],"description":"The CatFolders  WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders  WordPress plugin before 2.5.7's user restriction setting.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486/"}],"kev":null,"metrics":[],"modifiedAt":1793858429980,"publishedAt":1793858429980,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/cc0fd80d-3fd0-489c-985f-33fcca429486/"}],"remediation":[],"revision":"6b218d9ad4025ec64684281cc8a8f556ab338c160b807e83697fa9729bae697f","sources":[{"modifiedAt":1793858429980,"name":"CNA: WPScan","retrievedAt":1793858913302,"url":"https://www.cve.org/CVERecord?id=CVE-2026-107787"}],"ssvc":null,"status":"published","title":"CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge","updatedAt":1793858913302}