cve/2022/CVE-2022-4385.md

### [CVE-2022-4385](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4385)
![](https://img.shields.io/static/v1?label=Product&message=Intuitive%20Custom%20Post%20Order&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%203.1.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brighgreen)

### Description

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order

### POC

#### Reference
- https://wpscan.com/vulnerability/8f900d37-6eee-4434-8b9b-d10cc4a9167c

#### Github
No PoCs found on GitHub currently.