CVE-2022-4385

🗓️ 21 Feb 2023 08:50:40Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 49 Views🌐 WEB

The Intuitive Custom Post Order WordPress plugin before 3.1.4 allows unauthorized menu order updat

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2022-4385	21 Feb 202312:21	–	circl
CNNVD	WordPress Plugin Intuitive Custom Post Order 安全漏洞	21 Feb 202300:00	–	cnnvd
Cvelist	CVE-2022-4385 Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update	21 Feb 202308:50	–	cvelist
EUVD	EUVD-2022-51734	3 Oct 202520:07	–	euvd
NVD	CVE-2022-4385	21 Feb 202309:15	–	nvd
OpenVAS	WordPress Intuitive Custom Post Order Plugin < 3.1.4 Multiple Vulnerabilities	12 Jul 202300:00	–	openvas
OSV	CVE-2022-4385	21 Feb 202309:15	–	osv
Patchstack	WordPress Intuitive Custom Post Order Plugin <= 3.1.3 is vulnerable to Broken Access Control	24 Jan 202300:00	–	patchstack
Prion	Authorization	21 Feb 202309:15	–	prion
RedhatCVE	CVE-2022-4385	23 May 202500:00	–	redhatcve

NVD

Vulners

Node

intuitive_custom_post_order_project intuitive_custom_post_orderRange<3.1.4wordpress

[
  {
    "vendor": "Unknown",
    "product": "Intuitive Custom Post Order",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.1.4"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/8f900d37-6eee-4434-8b9b-d10cc4a9167c

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	The update-menu-order AJAX action lacks authorization checks, allowing any logged-in user (down to Subscriber) to update the menu order.	CWE-862
order	request body	/wp-admin/admin-ajax.php	The update-menu-order AJAX action lacks authorization checks, allowing any logged-in user (down to Subscriber) to update the menu order.	CWE-862

12 Mar 2025 17:15Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.14.3

EPSS0.0014

SSVC

CWE-862