> CVE-2026-9676

> DESCRIPTION

The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.

> AFFECTED_PRODUCTS

> GITHUB SECURITY ADVISORY

Authlib: empty signatures validation in JWS JSON deserialization

> HISTORIQUE DES MODIFICATIONS

> REFERENCES