CVE-2026-9676 — f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification

CVE-2026-9676

f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification PUBLISHED

Description (CNA)

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.

Affected (CNA)

Vendor / product	Versions
Unknown / F4 Post Tree	affected 0 before 2.0.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/54627b10-115c-4434-a17b-eb680244889f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.