WP Manifestindependent plugin directory
manifest / content / post-type-order

Post type order WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Order posts in any post type. Made for WordPress.

by Trendwerk · github.com/trendwerk/post-type-order · website

★ 2stars
1.0.4latest · 8mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/trendwerk/post-type-order/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/trendwerk/post-type-order ↗

Order posts in any post type. Made for WordPress.

Features

  • Allows admins to order posts from any post type in a separate "Order" menu
  • Automatically orders posts
  • Divide ordering by taxonomy

Installation

composer require trendwerk/post-type-order

Usage

Step 1

Add the post type support 'order' to any post type

'supports' => array( 'title', 'editor', 'revisions', 'order' )

Step 2 (optional)

You can divide the post type ordering by taxonomy

'supports'          => array( 'title', 'editor', 'revisions', 'order' ),
'order_by_taxonomy' => $taxonomy

If you want to use this, it's impossible to do automatic ordering. You will need to adjust the query manually. Below is an example of a custom loop. This is a little more complex, but I'm sure you'll figure it out.

$posts = new WP_Query( array(
    'post_type' => $post_type,
    'post__in'  => TP_Post_Type_Order::get_posts( $term, $taxonomy, $post_type ),
    'orderby'   => 'post__in'
) );

Step 3

Order up!

Releases

5 releases.

Tag
Published
1.0.4 latest
Feb 13, 2026 8mo ago
1.0.3
Mar 13, 2023 3 years ago
1.0.2
Aug 5, 2016 10 years ago
1.0.1
Jan 22, 2016 10 years ago
1.0.0
Jan 30, 2015 11 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Post type order 1.0.4 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.4
Findings
1
Worst severity
high
Content hash
c4a5386b9068c2d4800647ad…

Findings

  • high Post reordering AJAX has no nonce or capability check

    missing_auth

    wp_ajax_tp_pt_order calls order() which reads $_POST['order'] and runs wp_update_post(menu_order) or update_option('tp-pt-order') with zero authentication beyond being logged in. Any Subscriber can reorder all posts or taxonomy-scoped order options, disrupting site navigation and content order.

    class-tp-post-type-order.php:26-26,240-260

    Recommendation

    Require check_ajax_referer and current_user_can('edit_others_posts') or edit_post for each ID before updating menu_order; reject Subscribers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →