WP Sort Order

WP Sort Order has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 2 of the records (100%).

Every one of the 2 issues recorded for WP Sort Order has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. WP Sort Order is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

4.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Sort Order vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-28567

WP Sort Order <= 1.3.5 - Missing Authorization

Read the full analysis

Vulnerability Records

2 records


2026-08-14 00:00	WP Sort Order <= 1.3.5 - Missing Authorization WP Sort Order <= 1.3.5	`CVE-2026-28567`	5.3 Medium	hhhai	Yes
2024-04-05 00:00	WP Sort Order <= 1.3.1 - Missing Authorization WP Sort Order <= 1.3.1	`CVE-2024-31294`	4.3 Medium	CatFather	Yes

Showing 1–2 of 2 reports

Latestv1.3.6

WP Sort Order

Author

Fahad Mahmood

4.5(17)

90/100

Last Updated

2026-09-05 (7d ago)

Active Installs

6,000+

Downloads

94,232

Requires WP

3.5.0+

Requires PHP

7.0+

Tested up to

WP 7.1

Created

2016-03-01 (11y ago)

Author: Fahad Mahmood Project URI: http://androidbubble.com/blog/wordpress/plugins/wp-sort-order License: GPL 3. See License below for copyright jots and titles. Order terms (Users, Posts, Pages, Custom Post Types and Custom Taxonomies) using a Drag and Drop with jQuery ui Sortable. Select sortable items from ‘WP Sort Order’ menu of Setting menu in WordPress. In addition, You can re-override the parameters of ‘orderby’ and ‘order’, by using the ‘WP_Query’ or ‘pre_get_posts’ or ‘query_posts()’. The ‘get_posts()’ is excluded. At a glance by WordPress Mechanic: License This WordPress Plugin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or any later version. This free software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this software. If not, see http://www.gnu.org/licenses/gpl-2.0.html.

View on WordPress.org