CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Category/Post Type Post order: from n/a through <= 1.6.0.
Explanation of Vulnerability in Simple Terms
The Custom Category/Post Type Post order plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify post ordering and availability settings they should not have access to. An attacker with a basic user account can alter the integrity of post organization and disable posts without proper permission checks. This affects versions 1.6.0 and earlier.
What an attacker can do
Modify post order and disable posts without proper authorization.
Potential impact on your site
Unauthorized users can disrupt post organization and take posts offline, affecting site content management and visitor experience.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Contributor or Author role).
Key dates
External resources
Related vulnerabilities
