Technical impact
The vulnerability is a missing authorization flaw in the PostX plugin for WordPress, allowing attackers to bypass access control checks and perform actions normally limited to privileged users. This can enable the creation, editing, or deletion of posts and other content published through the plugin, potentially leading to site defacement or data leakage. The weakness is classified as Missing Permissions (CWE-862).
Affected Systems
Affected components are the WPXPO PostX "ultimate-post" plugin, for all versions up to and including 4.1.36. Users running any of these versions, regardless of other WordPress configurations, are potentially impacted.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity vulnerability, while the EPSS of less than 1% suggests a low probability of exploitation on a global scale at this time. The plugin is not currently listed in the CISA KEV catalog. The likely attack vector is via HTTP requests to administrative endpoints of the plugin, exploiting the lack of proper permission checks
