Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update
published February 21, 2023
CVSS
—
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is
The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Published
2023-02-21T08:50Z
EPSS history
Timeline
21 FEB 08:50Z
Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update