CVE-2026-24542: 
WordPress vulnerability analysis and mitigation

CVE-2026-24542 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Term Order WordPress plugin, developed by John James Jacoby. It affects all versions up to and including 2.1.0, and was disclosed on January 23–24, 2026, with the CVE record received from Patchstack. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), as assessed by CISA-ADP (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from insufficient or absent CSRF token validation in the WP Term Order plugin's request handling logic. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or privileged user, triggers unauthorized state-changing actions within the plugin — such as reordering taxonomy terms — without the user's knowledge or consent. No authentication is required on the attacker's side; only user interaction (e.g., clicking a crafted link) is needed to complete the attack (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users to execute unwanted actions under their current authentication context, primarily affecting data integrity. The confidentiality and availability impacts are assessed as none, while integrity impact is low — an attacker could manipulate term ordering or other plugin-controlled settings without the victim's awareness. The scope is limited to the affected WordPress installation, with no direct path to remote code execution or data exfiltration based on available information (Patchstack).

There is no evidence of active in-the-wild exploitation or public proof-of-concept exploit code for CVE-2026-24542 at this time. The EPSS score is extremely low at approximately 0.008%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, though this specific issue is rated low priority (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Term Order plugin version 2.1.0 or earlier, using tools like WPScan or passive enumeration of plugin directories.
2. Craft malicious request: Construct an HTML page or link containing a forged HTTP request targeting the WP Term Order plugin's state-changing endpoint (e.g., a form or AJAX call that reorders taxonomy terms), without any CSRF token.
3. Deliver payload: Trick an authenticated WordPress administrator or privileged user into visiting the crafted page or clicking the malicious link — via phishing email, comment injection, or social engineering.
4. Trigger unauthorized action: The victim's browser automatically submits the forged request with their active session credentials, causing the plugin to execute the attacker-specified action (e.g., reordering terms) without the user's consent (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to WP Term Order plugin endpoints from unusual referrer URLs or external domains.
• Application: Unexplained changes to taxonomy term ordering in the WordPress admin panel without corresponding administrator activity.
• Network: HTTP requests to WordPress admin-ajax.php or plugin-specific endpoints originating from external or unfamiliar referrer headers.

The vulnerability is patched in WP Term Order version 2.2.0. Site administrators should update the plugin to version 2.2.0 or later immediately via the WordPress admin dashboard or manually. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin area using IP allowlisting. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher Nabil Irawan on December 25, 2025, and published by Patchstack on January 24, 2026. Patchstack classified it as low priority with no significant community or media discussion identified beyond the initial advisory (Patchstack).