CVE-2026-1378: CSRF in WP Posts Re-order WordPress Plugin

An attacker exploiting this CSRF vulnerability can leverage a forged request to modify critical plugin settings within the WordPress environment. Specifically, they can alter capability, autosort, and adminsort configurations. Successful exploitation could lead to unauthorized changes in post ordering, potentially disrupting content management workflows. While the vulnerability doesn't directly expose sensitive data, it can be used to gain control over plugin behavior and potentially escalate privileges if combined with other vulnerabilities. This vulnerability is similar to other CSRF flaws where user interaction (clicking a malicious link) is required for exploitation.

1. Reserved2026-01-23
2. Published2026-03-21
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-1378 is to upgrade to a patched version of the WP Posts Re-order plugin as soon as it becomes available. Until a fix is released, implement temporary workarounds to reduce the risk. Consider using a WordPress security plugin with CSRF protection features, which can add nonce validation to plugin settings pages. Additionally, restrict access to plugin settings pages to authorized administrators only. Monitor WordPress access logs for suspicious requests targeting the cptpluginoptions() function. After upgrading, verify the plugin settings have not been altered by reviewing the configuration.

Active installs

70

Plugin rating