What is the CVSS score of CVE-2026-1378?

CVE-2026-1378 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1378?

Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in all should be aware of moderate risk from CVE-2026-1378, a cross-site request forgery vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-1378?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery in and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WordPress CVE-2026-1378

EUVD-2026-14006 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-jpp3-8q76-54rx

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14006

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the cpt_plugin_options() function. This makes it possible for unauthenticated attackers to update the plugin settings including capability, autosort, and adminsort settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The WP Posts Re-order WordPress plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0 due to missing nonce validation in the cpt_plugin_options() function. An unauthenticated attacker can exploit this to modify critical plugin settings including capability, autosort, and adminsort configurations by tricking a site administrator into clicking a malicious link. The vulnerability has a CVSS score of 4.3 (medium severity) with low attack complexity and requires user interaction, and while no public exploit code has been reported, the straightforward nature of CSRF attacks means proof-of-concept development is trivial.

Technical ContextAI

This vulnerability exploits the absence of nonce (number used once) validation in WordPress plugin security architecture. WordPress nonces are cryptographic tokens that prevent CSRF attacks by ensuring that state-changing requests originate from authenticated sessions within the application. The affected plugin (cpe:2.3:a:suifengtec:wp_posts_re-order:*:*:*:*:*:*:*:*) fails to implement WordPress security best practices by not validating nonces on the cpt_plugin_options() function (visible in the plugin source at https://plugins.trac.wordpress.org/browser/wp-posts-re-order/trunk/wp-posts-re-order.php#L572 and the tagged 1.0 version). This falls under CWE-352 (Cross-Site Request Forgery), a fundamental web application security weakness where trust relationships between browsers and servers are abused to execute unauthorized actions.

RemediationAI

The primary remediation is to disable or remove the WP Posts Re-order plugin immediately until the vendor releases a patched version that includes nonce validation on the cpt_plugin_options() function. Monitor the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/wp-posts-re-order/) and the vendor's security channels for an updated release. As an interim mitigation, restrict administrative access to your WordPress site to trusted IP addresses via firewall or .htaccess rules to reduce the likelihood of an attacker successfully tricking an administrator into clicking a malicious link. Additionally, ensure all administrators are educated on phishing and social engineering tactics that would be used to deliver such CSRF attacks. If the plugin functionality is critical to your site operations, consider commissioning a security patch from a WordPress security firm or switching to an alternative plugin with equivalent features that has undergone security review.