The WordPress WP Term Order plugin version 2.1.0 and earlier suffers from a Cross‑Site Request Forgery vulnerability (CWE‑352). A crafted request originating from an external site can trigger the plugin to reorder taxonomy terms or modify term status without the target user’s explicit intent. An attacker can thereby alter site content or taxonomy structure, potentially affecting navigation, post categorization, and other functionality that relies on term ordering.

Affected applications are WordPress installations that have the WP Term Order plugin by John James Jacoby with a plugin version of 2.1.0 or earlier installed. No other plugins or WordPress core components are listed as vulnerable.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score of less than 1% denotes a very low likelihood of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to entice a logged‑in user to visit a malicious link or submit a forged form that the attacker controls. The compromised account would then be able to perform unintended term reordering actions. The low exploit probability combined with moderate impact suggests that patching or mitigation should be prioritized but does not require immediate emergency response.