CVE-2026-1378 is a Cross-Site Request Forgery vulnerability in the WP Posts Re-order plugin for WordPress, affecting all versions up to and including 1.0. The root cause is the absence of nonce validation in the cpt_plugin_options() function, which handles plugin settings updates. This flaw enables attackers to send forged requests that, if executed by an authenticated administrator, can alter plugin settings such as capability, autosort, and adminsort options without proper authorization.

An attacker can cause an authenticated site administrator to unknowingly change plugin settings by tricking them into clicking a malicious link or performing a crafted action. This can lead to unauthorized modification of plugin configuration, potentially affecting site behavior related to post ordering. The vulnerability does not directly impact confidentiality or availability but allows limited integrity impact on plugin settings.

No official patch or fix is currently available for this vulnerability. Administrators should exercise caution when interacting with links or actions that could trigger plugin settings changes. Monitor vendor advisories for updates or patches addressing nonce validation in the plugin. Applying security best practices such as limiting administrator access and using security plugins that detect CSRF attempts may help reduce risk until a fix is released.