The vulnerability in the F4 Post Tree WordPress plugin allows any authenticated user with Subscriber-level access or higher to change the parent and menu order of any post without performing a capability check or CSRF/nonce verification. It is inferred that by submitting an Ajax request to the vulnerable action the attacker can reorder posts or move children between different parent posts, potentially altering the site’s structure and presentation of content.

WordPress sites running the F4 Post Tree plugin, version 2.0.4 or earlier, are impacted. The issue resides in the plugin’s Ajax endpoint which is enabled for both Subscribers and higher roles.

The CVSS score is 4.3, the EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. However, the risk remains significant because the attacker only needs a legitimate Subscriber account and can act without additional authentication steps. It is inferred that the lack of CSRF protection may allow the exploit to be performed from a malicious Web page or automated script if the user is logged in. Given the potential to disrupt site navigation or manipulate marketing content, the overall risk is high for any site using the affected plugin version.