WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update

An attacker exploiting this CSRF vulnerability can leverage a forged request to modify critical plugin settings within the WordPress environment. Specifically, they can alter capability, autosort, and adminsort configurations. Successful exploitation could lead to unauthorized changes in post ordering, potentially disrupting content management workflows. While the vulnerability doesn't directly expose sensitive data, it can be used to gain control over plugin behavior and potentially escalate privileges if combined with other vulnerabilities. This vulnerability is similar to other CSRF flaws where user interaction (clicking a malicious link) is required for exploitation.

WordPress websites utilizing the WP Posts Re-order plugin, particularly those with shared hosting environments or where administrators are susceptible to social engineering attacks, are at increased risk. Sites with multiple administrators or those lacking robust access control measures are also more vulnerable.

• wordpress / composer / npm:

grep -r 'cpt_plugin_options()' /var/www/html/wp-content/plugins/wp-posts-re-order/

• wordpress / composer / npm:

wp plugin list --status=active | grep 'wp-posts-re-order'

• wordpress / composer / npm:

wp plugin update wp-posts-re-order --all

1. 2026-03-21Disclosure

   disclosure

Aktive Installationen

70

Plugin-Bewertung

4.0

Erfordert WordPress

2.8+

Kompatibel bis

3.9.40

1. Reserviert2026-01-23
2. Veröffentlicht2026-03-21
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-28

The primary mitigation for CVE-2026-1378 is to upgrade to a patched version of the WP Posts Re-order plugin as soon as it becomes available. Until a fix is released, implement temporary workarounds to reduce the risk. Consider using a WordPress security plugin with CSRF protection features, which can add nonce validation to plugin settings pages. Additionally, restrict access to plugin settings pages to authorized administrators only. Monitor WordPress access logs for suspicious requests targeting the cptpluginoptions() function. After upgrading, verify the plugin settings have not been altered by reviewing the configuration.