CVE-2022-4385

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 40th percentile

Published

2023-02-21

Updated

2025-03-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8f900d37-6eee-4434-8b9b-d10cc4a9167c

References

• CVE Record
• NVD entry

Related

• CVE-2022-4384
• CVE-2022-4386
• CVE-2022-4383
• CVE-2022-4391
• CVE-2022-4381
• CVE-2022-4392