CVE-2022-4385

Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order

Affected

Intuitive Custom Post Order

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2023-02-21

Updated

2025-03-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8f900d37-6eee-4434-8b9b-d10cc4a9167c

References

• CVE Record
• NVD entry