{
 "id": "WPSEC-2026-1012",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1012/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1012/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1012/index.md",
 "title": "WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.33 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Modification via Re-order AJAX Actions",
 "description": "The WPZOOM Portfolio Lite plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the set_featured, save_order and reorder_items AJAX actions in versions 1.3.0 to 1.4.33. The handlers only verified a nonce, which was exposed to any user with the edit_posts capability on the portfolio Re-order page, and then updated whichever post IDs the request supplied. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the post type of arbitrary posts and pages to the portfolio type, change their menu order, and reset the order of all portfolio items.",
 "plugin": {
  "slug": "wpzoom-portfolio",
  "name": "WPZOOM Portfolio Lite – Filterable Portfolio Plugin",
  "full_name": "WPZOOM Portfolio Lite – Filterable Portfolio Plugin",
  "wordpress_org": "https://wordpress.org/plugins/wpzoom-portfolio/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpzoom-portfolio/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpzoom-portfolio"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.3.0",
    "from_inclusive": true,
    "to": "1.4.34",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.3.0 before 1.4.34"
  ]
 },
 "introduced_in": "1.3.0",
 "fixed_in": "1.4.34",
 "remediation": "Update to 1.4.34 or later.",
 "fix_released": "2026-10-14T12:24:19+00:00",
 "published": "2026-10-15T12:51:52+00:00",
 "updated": "2026-10-14T19:50:13.350662+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1012/",
  "https://plugins.svn.wordpress.org/wpzoom-portfolio/tags/1.4.34/",
  "https://wordpress.org/plugins/wpzoom-portfolio/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpzoom-portfolio",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}