PT-2023-14375
CVE-2022-4386
·
Published
2023-02-21
·
Updated
2025-03-12
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4
Description
The issue lacks CSRF protection in its
update-menu-order ajax action, allowing an attacker to trick any user into changing the menu order via a CSRF attack.Recommendations
For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the
update-menu-order ajax action to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾