F4 Post Tree
Monthly
Missing authorization and CSRF protection in the F4 Post Tree WordPress plugin (versions before 2.0.5) allows any authenticated Subscriber-level user to arbitrarily modify the parent assignment and menu order of posts across the site. The vulnerable AJAX endpoint accepts requests without capability checks or nonce verification, meaning an attacker with only a basic WordPress account can restructure site content hierarchy. No public exploitation in the wild is confirmed (not in CISA KEV), but a proof-of-concept exploit is publicly available per WPScan, and the EPSS score of 0.11% (1st percentile) reflects the limited automated exploitation potential.
Missing authorization and CSRF protection in the F4 Post Tree WordPress plugin (versions before 2.0.5) allows any authenticated Subscriber-level user to arbitrarily modify the parent assignment and menu order of posts across the site. The vulnerable AJAX endpoint accepts requests without capability checks or nonce verification, meaning an attacker with only a basic WordPress account can restructure site content hierarchy. No public exploitation in the wild is confirmed (not in CISA KEV), but a proof-of-concept exploit is publicly available per WPScan, and the EPSS score of 0.11% (1st percentile) reflects the limited automated exploitation potential.