EUVD-2026-40040
GHSA-m9qg-5xmj-j7gg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber-level account required sets PR:L; only post ordering is affected setting I:L; no confidentiality or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.
AnalysisAI
Missing authorization and CSRF protection in the F4 Post Tree WordPress plugin (versions before 2.0.5) allows any authenticated Subscriber-level user to arbitrarily modify the parent assignment and menu order of posts across the site. The vulnerable AJAX endpoint accepts requests without capability checks or nonce verification, meaning an attacker with only a basic WordPress account can restructure site content hierarchy. No public exploitation in the wild is confirmed (not in CISA KEV), but a proof-of-concept exploit is publicly available per WPScan, and the EPSS score of 0.11% (1st percentile) reflects the limited automated exploitation potential.
Technical ContextAI
F4 Post Tree is a WordPress plugin that provides a tree-style management interface for post hierarchies and menu ordering, implemented via WordPress AJAX actions (wp_ajax_*). The root cause is a dual failure: the AJAX handler neither enforces WordPress capability checks (e.g., edit_others_posts) nor validates a nonce (CSRF token) before processing post rearrangement requests. In WordPress, AJAX actions exposed without nonce verification are exploitable both by authenticated low-privilege users directly and via cross-site request forgery against higher-privilege users. The CPE string (cpe:2.3:a:unknown:f4_post_tree:*:*:*:*:*:*:*:*) reflects that the vendor is not yet resolved in the NVD CPE dictionary. CWE is listed as N/A, but the vulnerability class maps to CWE-862 (Missing Authorization) and CWE-352 (Cross-Site Request Forgery).
RemediationAI
Update the F4 Post Tree plugin to version 2.0.5 or later, which is the vendor-released patch resolving both the missing capability check and the absent CSRF nonce verification. The fix can be applied directly from the WordPress admin plugin update screen or via WP-CLI. The WPScan advisory at https://wpscan.com/vulnerability/54627b10-115c-4434-a17b-eb680244889f/ confirms version 2.0.5 as the patched release. If immediate update is not possible, a compensating control is to restrict Subscriber-level user registration and ensure no untrusted users hold Subscriber or higher roles - disabling open user registration (Settings > General > Anyone can register) eliminates the lowest-privilege attack path. Note that this workaround does not address the CSRF vector, which can still be triggered against authenticated users of any role via a malicious external page.
Share
External POC / Exploit Code
Leaving vuln.today