Simple Custom Post Order <= 2.5.7 - Missing Authorization
mediumThe Simple Custom Post Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_menu_order_tags() function in versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update o...
- CVSS:
- 4.3
- Affected:
- up to 2.5.7
- Fixed in:
- 2.5.8
- Disclosed:
- Oct 15, 2024