Vulnerability · Published Nov 16, 2024 · Assigned by Wordfence
CVE-2024-10728PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
High 8.8
In plain English
A high-severity missing authorization in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX from wpxpo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 39.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and including, 4.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpxpo | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX | 0 – through 4.1.16 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/076f36fb-c2fb-43e0-a027-1351d3995489?source=cve
- https://plugins.trac.wordpress.org/browser/ultimate-post/tags/4.1.16/classes/Importer.php#L94
- https://plugins.trac.wordpress.org/browser/ultimate-post/tags/4.1.16/classes/Initialization.php#L330
- https://wordpress.org/plugins/ultimate-post/
- https://plugins.trac.wordpress.org/changeset/3188636/ultimate-post/trunk/classes/Importer.php