EUVD-2022-51734

Malicious code in bioql PyPI...

CVE-2022-4385

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4386

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

Cross site request forgery (csrf)

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4385 Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4385

Summary: The WordPress plugin Intuitive Custom Post Order (

CVE-2022-4386: Cross-Site Request Forgery (CSRF)

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

PT-2023-14374

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 Description The issue allows any logged-in user, with roles as low as Subscriber, to update the menu order due to a lack of authorization check in the update-menu-order ajax...

PT-2023-14375

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 Description The issue lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user into changing the menu order via a CSRF attack...

CVE-2022-4385: Missing Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...