CVE-2026-1883 describes an insecure direct object reference vulnerability in the Wicked Folders WordPress plugin, specifically in the delete_folders() function. Due to insufficient validation of a user-controlled key, authenticated users with Contributor-level privileges or above can delete arbitrary folders belonging to other users. This bypasses intended authorization controls and impacts the integrity of folder organization within the plugin. The vulnerability affects all versions up to 4.1.0. The CVSS 3.1 score is 4.3, reflecting a medium impact primarily on integrity without confidentiality or availability impact. No official patch or remediation guidance has been provided by the vendor as of the published date.

An authenticated attacker with Contributor-level or higher access can delete folders created by other users within the Wicked Folders plugin. This results in unauthorized modification of folder data, impacting data integrity. There is no direct impact on confidentiality or availability reported. The vulnerability could disrupt content organization but does not allow data disclosure or system compromise based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious folder deletion activity. Avoid granting unnecessary privileges to users to limit potential exploitation.