Simple Custom Post Order

Simple Custom Post Order has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Simple Custom Post Order has a vendor fix available, so running the current release closes it.

All of these findings were reported by Rafie Muhammad. Simple Custom Post Order is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Simple Custom Post Order vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2024-49321

Simple Custom Post Order <= 2.5.7 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Simple Custom Post Order banner
Latestv2.8.11

Simple Custom Post Order

colorlibplugins

Author

colorlibplugins

4.8(586)
96/100
Last Updated
2026-10-19 (9d ago)
Active Installs
300,000+
Downloads
5,559,970
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2013-07-24 (13y ago)

Simple Custom Post Order is the easiest way to manually sort your WordPress content using drag-and-drop functionality. Whether you’re managing blog posts, portfolio items, WooCommerce products, team members, testimonials, or any custom post type, this plugin gives you complete control over your content order. Why Choose Simple Custom Post Order? Quick Setup – Tick the post types and taxonomies to sort under Settings > SCPOrder, then drag Drag & Drop Interface – Intuitive sorting directly in your admin post lists Universal Compatibility – Works with any post type and taxonomy Lightweight & Fast – No bloat, minimal impact on site performance Modern & Dependency-Free – Vanilla JavaScript drag-and-drop (no jQuery UI) with touch and full keyboard support Reliable Saving – Robust AJAX saving that works behind reverse proxies, custom ports, and HTTPS setups Developer Friendly – Action and filter hooks for customization Key Features Sort Any Content Type Posts – Reorder your blog posts in any sequence you prefer Pages – Organize pages beyond alphabetical or date order Custom Post Types – Perfect for portfolios, team members, testimonials, products, events, FAQs, services, and more WooCommerce Products – Manually sort products in your shop Taxonomies – Reorder categories, tags, and custom taxonomies Intuitive Admin Interface Smooth drag-and-drop sorting directly in the WordPress post list table Touch-friendly — press, hold, and drag to reorder on phones and tablets Fully keyboard accessible — tab to a row, then use Space and the arrow keys to reorder, with screen-reader announcements Clear save feedback — a “Saving… / Order saved” status appears as you sort Drag handle — a grip icon appears on hover (on by default; can be turned off), and rows stay draggable from anywhere Page trees — dragging a parent page carries its child pages with it, and keyboard moves stay among a page’s siblings Optional “Order” column — type an exact position, handy for moving an item to another page of a long list Choose whether newly created items go to the top (default) or the bottom of the order Choose which user roles may reorder Changes saved automatically via AJAX – no page refresh needed, with a Retry button if a save fails Conflicting edits are rejected with a recovery message; the Modern engine offers a Reload list button The Modern engine warns before leaving with pending or failed saves Works seamlessly with the default WordPress admin experience Smart Query Integration Automatically applies the custom order to queries for enabled post types that don’t ask for a specific order Respects an explicit sort such as orderby => title (see the FAQ for the one get_posts() exception) Does not interfere with search results (maintains relevance sorting) Previous/next post links follow the custom order Compatible with get_posts(), WP_Query, and standard loops Opt out per query with 'scpo_ignore_custom_order' => true Reset & Restore One-click reset to restore default ordering Reset individual post types without affecting others Useful when you need to start fresh with your content organization Perfect For Bloggers – Feature important posts at the top of your blog Business Websites – Showcase key services or team members first Portfolio Sites – Display your best work in a specific order Online Stores – Highlight featured or seasonal products Membership Sites – Organize course content or resources News Sites – Pin important stories or announcements Event Websites – Arrange events in your preferred sequence Documentation Sites – Structure help articles logically Use Cases Portfolio Management Arrange your portfolio items to showcase your best work first, group similar projects together, or create a visual narrative of your creative journey. Team Page Organization Display team members by hierarchy, department, or seniority rather than by when they were added to the system. Product Highlighting Feature seasonal items, bestsellers, or new arrivals at the top of your WooCommerce shop without relying solely on sorting by date or price. Content Curation Create curated reading lists by manually ordering posts in the exact sequence you want readers to discover them. FAQ Organization Sort frequently asked questions by importance or topic, ensuring the most relevant questions appear first. Testimonial Display Show your most compelling testimonials first to maximize their impact on potential customers. Developer Features Action Hooks scp_update_menu_order – Fires after post order is updated, by drag-and-drop or the Order column (no arguments) scp_update_menu_order_tags – Fires after taxonomy term order is updated (no arguments) Filter Hooks scpo_post_types_args – Modify which post types appear in settings scpo_use_sortablejs – Force the drag engine in code (overrides the setting); return true for the modern SortableJS engine or false for the classic jQuery UI sorter scpo_capability – Change the capability required to reorder (default edit_posts) scpo_reverse_adjacent_posts – Return true to swap the direction of previous/next post links scpo_cache_flush_group_threshold – Number of changed rows (default 500) above which cached order values are cleared in bulk instead of one by one Example — let only editors and administrators reorder: add_filter( 'scpo_capability', function () { return 'edit_others_posts'; } ); Drag & Drop Engine Choose between the modern, dependency-free SortableJS engine (default) and the classic jQuery UI sorter under Settings > SCPOrder. The classic engine remains fully supported as a fallback. Advanced View Mode Enable the advanced view in settings to see all registered post types, including those normally hidden from the admin menu. Supported Post Types Simple Custom Post Order works with: WordPress Posts WordPress Pages WooCommerce Products Easy Digital Downloads Products Portfolio items (Jetpack, custom) Team member post types Testimonial post types Event post types (The Events Calendar, etc.) FAQ post types Any custom post type with show_ui enabled that appears in the admin menu (turn on Advanced View in Settings to list the rest) Supported Taxonomies Categories Tags WooCommerce Product Categories WooCommerce Product Tags Custom taxonomies with show_ui enabled How It Works Install & Activate – Install the plugin from WordPress.org or upload manually Configure – Go to Settings > SCPOrder and select which post types and taxonomies to enable (nothing is sorted until you do) Reorder – Visit any enabled post type list and drag items to reorder Done – Your custom order is automatically applied across your site The plugin uses WordPress’s native menu_order field for posts and pages, and adds a term_order column for taxonomy terms. This approach ensures compatibility and data persistence. Performance Optimized Targeted cache invalidation (only clears cache for modified items) Batched database writes that only touch rows whose order actually changed Scripts loaded only on relevant admin pages No front-end performance impact Security First All database queries use prepared statements AJAX requests protected with nonce verification Capability checks ensure only authorized users can reorder Input sanitization on all user data Additional Information Support For support questions, please use the WordPress.org support forum. Bug Reports Report bugs on our GitHub repository. Contributing Contributions are welcome! Please submit pull requests to our GitHub repository. Credits This plugin is made with love by the team at Colorlib.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C