{
 "id": "WPSEC-2026-2342",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2342/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2342/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2342/index.md",
 "title": "WP Sort Order <= 1.3.6 - Missing Authorization to Unauthenticated Sort Order Refresh",
 "description": "The WP Sort Order plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.3.6, due to a missing capability check on the refresh() function. The plugin hooks this function to admin_init whenever the 'page' parameter is set to 'wpso-settings'. This makes it possible for unauthenticated attackers to trigger the re-numbering of post menu order and term order values for the configured post types and taxonomies, and the deletion and rebuilding of the plugin's user order meta, which can reset custom user ordering.",
 "plugin": {
  "slug": "wp-sort-order",
  "name": "WP Sort Order",
  "full_name": "WP Sort Order",
  "wordpress_org": "https://wordpress.org/plugins/wp-sort-order/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-sort-order/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-sort-order"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.3.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.3.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.3.7",
 "remediation": "Update to 1.3.7 or later.",
 "fix_released": "2026-10-31T05:43:48+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:31.973890+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2342/",
  "https://plugins.svn.wordpress.org/wp-sort-order/tags/1.3.7/",
  "https://wordpress.org/plugins/wp-sort-order/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-sort-order",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}