CVE-2026-1378

Name of the Vulnerable Software and Affected Versions WP Posts Re-order plugin for WordPress versions prior to 1.1

Description The WP Posts Re-order plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of nonce validation in the cpt plugin options() function. Successful exploitation allows unauthenticated attackers to modify plugin settings, including capability, autosort, and adminsort settings, by deceiving a site administrator into performing an action.

Recommendations Update the WP Posts Re-order plugin to version 1.1 or later.