WordPress WP Term Order plugin <= 2.1.0 - Vulnérabilité Cross Site Request Forgery (CSRF)

A successful CSRF attack could allow an attacker to maliciously alter the order of terms within WordPress custom taxonomies. This could disrupt website functionality, change content organization, or even be used as a stepping stone for further attacks if other vulnerabilities exist. The attacker would need to trick a legitimate user into visiting a malicious webpage crafted to exploit the vulnerability. While the direct impact might seem limited to term order, the potential for cascading effects and manipulation of website content should be considered.

Websites using the WP Term Order plugin, particularly those with custom taxonomies and user roles with the ability to modify term order, are at risk. Shared hosting environments where plugin updates are not consistently managed are also more vulnerable.

• wordpress / composer / npm:

grep -r 'wp_term_order_reorder_terms' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep wp-term-order

• wordpress / composer / npm:

wp plugin list | grep wp-term-order

1. 2026-01-23Disclosure

   disclosure

1. Réservé2026-01-23
2. Publiée2026-01-23
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade the WP Term Order plugin to version 2.2.0 or later, which contains the fix. If immediate upgrading is not possible, consider implementing a Content Security Policy (CSP) to restrict the sources from which the browser can load resources. Additionally, using a WordPress security plugin with CSRF protection can provide an extra layer of defense. Regularly review user activity logs for suspicious requests.

Installations actives

6KNiche

Note du plugin