Simple Custom Post Order <= 2.5.7 is vulnerable to Broken Access Control vulnerability

The Simple Custom Post Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_menu_order_tags() function in versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update order tags.