CVE-2022-4386: Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-02-21 · updated 2026-06-17
Weakness: CWE-352

Description

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack

Affected products

Intuitive Custom Post Order: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: Intuitive Custom Post Order 3.1.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/734064e3-afe9-4dfd-8d76-8a757cc94815
https://wpscan.com/vulnerability/734064e3-afe9-4dfd-8d76-8a757cc94815

Get alerted when CVE-2022-4386 or the next vulnerability affects your stack