This vulnerability in the faaiq Custom Category/Post Type Post order plugin arises from incorrectly configured access control, specifically missing authorization checks. It affects versions up to and including 1.6.0. The issue allows users with low privileges to manipulate post ordering without proper authorization, potentially impacting the integrity and availability of the affected system. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows unauthorized modification of post order settings, which can lead to integrity and availability issues within the affected application. Confidentiality is not impacted. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to trusted users only and review permissions related to post order management to minimize risk.