WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.33 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Modification via Re-order AJAX Actions
- ID
- WPSEC-2026-1012
- Plugin
- WPZOOM Portfolio Lite – Filterable Portfolio Plugin (wpzoom-portfolio)
- Affected
- from 1.3.0 before 1.4.34
- Remediation
- Update to 1.4.34 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- WPZOOM Portfolio Lite – Filterable Portfolio Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The WPZOOM Portfolio Lite plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the set_featured, save_order and reorder_items AJAX actions in versions 1.3.0 to 1.4.33. The handlers only verified a nonce, which was exposed to any user with the edit_posts capability on the portfolio Re-order page, and then updated whichever post IDs the request supplied. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the post type of arbitrary posts and pages to the portfolio type, change their menu order, and reset the order of all portfolio items.
References
- https://wpsec.com/vuln/WPSEC-2026-1012/
- https://plugins.svn.wordpress.org/wpzoom-portfolio/tags/1.4.34/
- https://wordpress.org/plugins/wpzoom-portfolio/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS