CVE-2023-1016

The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'update_options' function as well as the 'refresh' function which runs queries on the same values. This allows authenticated attackers, with administrator permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note that this attack may only be practical on configurations where it is possible to bypass addslashes due to the database using a nonstandard character set such as GBK.

• CWE-89

• https://plugins.trac.wordpress.org/browser/intuitive-custom-post-order/trunk/intuitive-custom-post-order.php?rev=2530122Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3012639%40intuitive-custom-post-order&new=3012639%40intuitive-custom-post-order&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dc878508-200d-4bc7-aa99-c34e63cba4b3?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/intuitive-custom-post-order/trunk/intuitive-custom-post-order.php?rev=2530122Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dc878508-200d-4bc7-aa99-c34e63cba4b3?source=cveThird Party Advisory

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1009** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified a…5.5
• CVE-2023-1010A vulnerability classified as critical was found in vox2png …5.5
• CVE-2023-1011The AI ChatBot WordPress plugin before 4.4.5 does not escape…6.1
• CVE-2023-1013Improper Neutralization of Script-Related HTML Tags in a Web…6.1
• CVE-2023-1014Improper Protection for Outbound Error Messages and Alert Si…7.5
• CVE-2023-1015Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-1017An out-of-bounds write vulnerability exists in TPM2.0's Modu…7.8
• CVE-2023-1018An out-of-bounds read vulnerability exists in TPM2.0's Modul…5.5
• CVE-2023-1019The Help Desk WP WordPress plugin through 1.2.0 does not san…5.4
• CVE-2023-1020The Steveas WP Live Chat Shoutbox WordPress plugin through 1…9.8
• CVE-2023-1021The amr ical events lists WordPress plugin through 6.6 does …4.8
• CVE-2023-1022The WP Meta SEO plugin for WordPress is vulnerable to unauth…4.3