CVE-2022-4386

Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRF

published February 21, 2023

CVSS
—
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Published
2023-02-21T08:51Z
EPSS history
Timeline
  • 21 FEB 08:51Z
    Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRF
    cvelistv5