CVE-2026-9676

The CVE-2026-9676 affects the F4 Post Tree WordPress plugin prior to version 2.0.5. An AJAX action lacks capability checks and CSRF/nonce verification, allowing authenticated users with Subscriber-level access or higher to modify the parent and menu order of arbitrary posts. Root cause: missing a...