CVE-2022-4386

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4

Description The issue lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user into changing the menu order via a CSRF attack.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the update-menu-order ajax action to minimize the risk of exploitation.