CVE-2026-24542: CSRF in WP Term Order WordPress Plugin

A successful CSRF attack could allow an attacker to maliciously alter the order of terms within WordPress custom taxonomies. This could disrupt website functionality, change content organization, or even be used as a stepping stone for further attacks if other vulnerabilities exist. The attacker would need to trick a legitimate user into visiting a malicious webpage crafted to exploit the vulnerability. While the direct impact might seem limited to term order, the potential for cascading effects and manipulation of website content should be considered.

1. Reserved2026-01-23
2. Published2026-01-23
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the WP Term Order plugin to version 2.2.0 or later, which contains the fix. If immediate upgrading is not possible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources. Additionally, using a WordPress security plugin with CSRF protection can provide an extra layer of defense. Regularly review user activity logs for suspicious requests.

Active installs

6KNiche

Plugin rating