The Folderly WordPress plugin contains an authorization flaw (CWE-863) in its REST API endpoint /wp-json/folderly/v1/config/clear-all-data. This flaw allows any authenticated user with Author-level privileges or above to clear critical data like terms and categories due to insufficient capability checks. The vulnerability affects all versions up to 0.3. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and requiring low privileges but no user interaction. No known exploits in the wild have been reported, and no patch or remediation guidance is currently available.

An attacker with Author-level or higher access can clear all data managed by the Folderly plugin, including terms and categories, potentially disrupting site content organization and functionality. The vulnerability does not allow confidentiality or availability impacts beyond data modification. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity involving the affected REST API endpoint. Avoid granting Author or higher privileges to untrusted users.