EUVD-2026-14006
GHSA-jpp3-8q76-54rx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the cpt_plugin_options() function. This makes it possible for unauthenticated attackers to update the plugin settings including capability, autosort, and adminsort settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The WP Posts Re-order WordPress plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0 due to missing nonce validation in the cpt_plugin_options() function. An unauthenticated attacker can exploit this to modify critical plugin settings including capability, autosort, and adminsort configurations by tricking a site administrator into clicking a malicious link. The vulnerability has a CVSS score of 4.3 (medium severity) with low attack complexity and requires user interaction, and while no public exploit code has been reported, the straightforward nature of CSRF attacks means proof-of-concept development is trivial.
Technical ContextAI
This vulnerability exploits the absence of nonce (number used once) validation in WordPress plugin security architecture. WordPress nonces are cryptographic tokens that prevent CSRF attacks by ensuring that state-changing requests originate from authenticated sessions within the application. The affected plugin (cpe:2.3:a:suifengtec:wp_posts_re-order:*:*:*:*:*:*:*:*) fails to implement WordPress security best practices by not validating nonces on the cpt_plugin_options() function (visible in the plugin source at https://plugins.trac.wordpress.org/browser/wp-posts-re-order/trunk/wp-posts-re-order.php#L572 and the tagged 1.0 version). This falls under CWE-352 (Cross-Site Request Forgery), a fundamental web application security weakness where trust relationships between browsers and servers are abused to execute unauthorized actions.
RemediationAI
The primary remediation is to disable or remove the WP Posts Re-order plugin immediately until the vendor releases a patched version that includes nonce validation on the cpt_plugin_options() function. Monitor the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/wp-posts-re-order/) and the vendor's security channels for an updated release. As an interim mitigation, restrict administrative access to your WordPress site to trusted IP addresses via firewall or .htaccess rules to reduce the likelihood of an attacker successfully tricking an administrator into clicking a malicious link. Additionally, ensure all administrators are educated on phishing and social engineering tactics that would be used to deliver such CSRF attacks. If the plugin functionality is critical to your site operations, consider commissioning a security patch from a WordPress security firm or switching to an alternative plugin with equivalent features that has undergone security review.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today