Intuitive Custom Post Order <= 3.1.3 - Missing Authorization to Authenticated Settings Change
2023-01-25 00:00
AnonymousStrategic Overview
StatusPatched in 3.1.4
Affected PluginIntuitive Custom Post Order
Affected Version
<= 3.1.3CVSS4.3Medium
CVE
N/AVulnerability Overview
The Intuitive Custom Post Order plugin for WordPress is vulnerable to authenticated settings change in versions up to and including 3.1.3 via the 'update-menu-order-sites' AJAX action. This allows authenticated attackers with subscriber privileges or above, to change the order of sites in the sites menu on multisite installations.
Technical Analysis
REMEDIATION: Update to version 3.1.4, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C