EUVD-2026-60892
GHSA-fr2v-9mf5-f6x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with WP Sort Order ≤1.3.5
-
DeliveryLocate unprotected plugin endpoint (AJAX or REST route)
-
ExploitSend unauthenticated HTTP request to endpoint
-
ExecutionBypass missing authorization check
-
ImpactExfiltrate restricted data from response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for exploitation beyond the WP Sort Order plugin being installed and active in a version at or below 1.3.5. The CVSS vector confirms PR:N and AC:L - no credentials, no privileged network position, no non-default configuration, and no user interaction are needed. Any unauthenticated remote actor with HTTP access to the WordPress site can trigger the vulnerability against a default plugin installation. Exploitation is bounded by two factors: the plugin must be actively installed and enabled (deactivated plugins are not exploitable), and the impact is limited to confidentiality (I:N, A:N) - attackers cannot modify data or disrupt service availability. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) signals a wide attack surface: no authentication, no complexity barrier, no user interaction required. However, the I:N and A:N ratings meaningfully bound the real-world impact - an attacker cannot alter content, modify settings, or disrupt availability, limiting this to a data-exposure class of vulnerability. The vulnerability is not listed in CISA KEV, and no EPSS probability data was provided in the available intelligence, making exploitation frequency assessment uncertain. Reported by Patchstack, a reputable WordPress security research firm, which adds credibility. Because WP Sort Order is a niche plugin with a limited install base, aggregate internet-wide exposure is low despite the per-installation severity rating of 7.5. This vulnerability is a real priority for any site running the affected plugin but is not a broadly systemic risk. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates a WordPress site and identifies the WP Sort Order plugin via response headers or plugin-specific asset paths. The attacker sends a crafted HTTP POST or GET request directly to the plugin's unprotected AJAX action or REST endpoint, bypassing the missing authorization check, and receives restricted data in the response. The low attack complexity makes this trivially scriptable, enabling automated scanning and bulk targeting of WordPress installations running the affected plugin version. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
RemediationAI
Check the WordPress plugin repository for an updated version of WP Sort Order above 1.3.5; a patched release version is not independently confirmed from the available intelligence, so administrators should monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-sort-order/vulnerability/wordpress-wp-sort-order-plugin-1-3-5-broken-access-control-vulnerability for a confirmed fix version. If no patched release is available or cannot be applied immediately, deactivate the WP Sort Order plugin entirely until a fix is released - this fully eliminates the attack surface at the cost of losing the plugin's sorting functionality. As an alternative compensating control, a web application firewall (WAF) configured to block unauthenticated requests to the plugin's AJAX or REST endpoints can reduce exposure, though identifying the exact vulnerable endpoint requires further investigation of the plugin's source code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Sort Order is a WordPress plugin authored by Fahad Mahmood (CPE: cpe:2.3:a:fahad_mahmood:wp_sort_order:*:*:*:*:*:*:*:*) that controls the display ordering of WordPress posts or content types. The root cause is CWE-862 (Missing Authorization): one or more plugin-registered endpoints - typically WordPress AJAX hooks or REST API routes - lack capability checks or nonce verification, making them reachable without authentication. In WordPress, this commonly occurs when developers use wp_ajax_nopriv_ action hooks or register REST API routes without a permission_callback, inadvertently exposing administrative functions to the public. The CVSS C:H/I:N/A:N profile indicates the exposed functionality grants read access to data that should be access-controlled, but does not permit writes or cause service disruption.
Know when Wp Sort Order gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated endpoint with no complexity barrier; C:H reflects protected data exposure; I:N and A:N confirmed by read-only access control bypass with no modification or disruption capability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
Executive ViewAI
The WP Sort Order WordPress plugin (versions 1.3.5 and below) contains an unauthenticated broken access control vulnerability allowing any internet user to invoke restricted plugin functions and access protected data without credentials; no public exploit identified at time of analysis, but the attack's simplicity creates urgent risk of data exposure. Organizations running this plugin face immediate threat of unauthorized access to sensitive information by external attackers. This affects all WordPress installations with the vulnerable plugin active and requires remediation within 24 hours.
No vendor-released patch identified at time of analysis. Interim mitigations include: immediate deactivation of WP Sort Order plugin on all installations; restricting network access to plugin functions via IP whitelist; deploying WAF rules to block suspicious requests to the plugin; establishing continuous monitoring of WordPress logs for exploitation attempts; and accelerating deployment of an alternative plugin or patched version within 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB