WordPress · Intuitive Custom Post Order · CVE-2022-4385
**Name of the Vulnerable Software and Affected Versions**
Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4
**Description**
The issue allows any logged-in user, with roles as low as Subscriber, to update the menu order due to a lack of authorization check in the `update-menu-order` ajax action.
**Recommendations**
For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `update-menu-order` ajax action to prevent unauthorized menu order updates.