Input validation vulnerability in Wicked Folders 2.18.16

The Wicked Folders plugin for WordPress has a security issue in versions up to and including 2.18.16. An attacker can use a forged request to trick an administrator into performing an action like clicking a link. This link could lead to the attacker changing the folder structure of the plugin. This happens because the plugin does not properly validate the nonce on the ajax_clone_folder function.