Access violation vulnerability in Wicked Folders 2.18.16

The Wicked Folders plugin for WordPress has a security vulnerability that allows people with a certain level of access to do things they shouldn’t be able to do. This vulnerability affects versions up to and including 2.18.16 and allows people with a subscriber-level of access and above to use a function called ajax_save_sort_order which can change the way folders are organized. This is something only an administrator should be able to do.