# WP Sort Order <= 1.3.6 - Missing Authorization to Unauthenticated Sort Order Refresh

- **ID:** WPSEC-2026-2342
- **Plugin:** WP Sort Order (`wp-sort-order`), https://wordpress.org/plugins/wp-sort-order/
- **Affected versions:** all versions before 1.3.7
- **Fixed in:** 1.3.7 (Update to 1.3.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-sort-order
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2342/

## Description

The WP Sort Order plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.3.6, due to a missing capability check on the refresh() function. The plugin hooks this function to admin_init whenever the 'page' parameter is set to 'wpso-settings'. This makes it possible for unauthenticated attackers to trigger the re-numbering of post menu order and term order values for the configured post types and taxonomies, and the deletion and rebuilding of the plugin's user order meta, which can reset custom user ordering.

## References

- https://wpsec.com/vuln/WPSEC-2026-2342/
- https://plugins.svn.wordpress.org/wp-sort-order/tags/1.3.7/
- https://wordpress.org/plugins/wp-sort-order/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2342/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.