CVE-2022-4385

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4

Description The issue allows any logged-in user, with roles as low as Subscriber, to update the menu order due to a lack of authorization check in the update-menu-order ajax action.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the update-menu-order ajax action to prevent unauthorized menu order updates.