PT-2026-46387 · WordPress · Wp Meta Sort Posts

Muhammad Afnaan · CVE-2026-8940 · Published 2026-06-04 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Meta Sort Posts versions prior to 1.0

Description The WP Meta Sort Posts plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a type of attack where an unauthorized user tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation—a security token used to ensure requests are legitimate—on the top-level included script in the 'msp-options.php' endpoint. Unauthenticated attackers can exploit this to modify the msp loop file and msp nav location settings by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 0.9.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-8940

Affected Products

Wp Meta Sort Posts

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-8940 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-meta-sort-posts/trunk/msp-options.php#L30 · Note
• https://reddit.com/r/StopBadBots/comments/1u9fi90/critical_alert_unpatched_vulnerabilities_found · Reddit Post
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://wordfence.com/threat-intel/vulnerabilities/id/06efa097-38dc-4499-b163-7a6254b25f72?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-meta-sort-posts/trunk/msp-options.php#L27 · Note
• https://plugins.trac.wordpress.org/browser/wp-meta-sort-posts/trunk/msp-options.php#L18 · Note
• https://twitter.com/VulmonFeeds/status/2064238922561949914 · Twitter Post
• https://t.me/CVEtracker/56260 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-meta-sort-posts/trunk/wp-meta-sort-posts.php#L106 · Note