CVE-2026-9676— f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification
Possible ATT&CK Techniques 1AI
T1136.001 · Local AccountAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | F4 Post Tree | < 2.0.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9676
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification
Source: CVE Program / CVE List V5
Vulnerability Description
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress F4 Post Tree 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress F4 Post Tree是WordPress基金会的一款用于发布帖子的树状结构软件。 WordPress F4 Post Tree 2.0.5之前版本存在安全漏洞，该漏洞源于未执行权限检查或CSRF/nonce验证，允许已认证订阅者级别及以上用户修改任意文章的父级和菜单顺序。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | F4 Post Tree | 0 ~ 2.0.5 | - |
II. Public POCs for CVE-2026-9676
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9676
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-9676 (1)
- 🔗 f4 Post Tree < 2.0.5 – Subscriber+ Arbitrary Post Parent/Menu Order Modification | CVE 2026-9676 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14862
Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachm - CVE-2026-14919
ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Accou - CVE-2026-12697
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Messag - CVE-2026-12695
miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled - CVE-2026-13609
Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stor
V. Comments for CVE-2026-9676
No comments yet