CVE-2026-9676 · Symaro Security Advisory

Description

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.

Weaknesses

— CWE-862 Missing Authorization
— CWE-352 Cross-Site Request Forgery (CSRF)

Affected products

Vendor	Product	Versions
Unknown	F4 Post Tree	0 to <2.0.5

References

https://wpscan.com/vulnerability/54627b10-115c-4434-a17b-eb680244889f/ (exploit vdb-entry technical-description)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 29 Jun 2026 07:08 UTC.