The WPXPO PostX plugin contains an incorrect privilege assignment flaw that enables privilege escalation. Classified as CWE‑266, this weakness permits software to grant higher-level permissions than intended. The CVE description states that the vulnerability allows an attacker to gain elevated privileges, but it does not detail the exact actions an attacker could perform. Based on the description, it is inferred that an authenticated user with limited rights could potentially exploit the flaw to obtain administrative capabilities.

WordPress sites that use the WPXPO PostX (ultimate‑post) plugin versions up through 4.1.35 are affected. Versions prior to the listed maximum and any bundled plugin found in those releases are at risk.

The CVSS score of 7.2 indicates a high severity flaw, while the EPSS score of less than 1% suggests that exploitation activity is currently rare. The vulnerability is not listed in CISA’s KEV catalog. The description does not specify whether remote or local context is required, but the nature of privilege assignment typically requires the attacker to possess an existing authenticated user account. Consequently, the threat is primarily an internal one, with potential impact on the confidentiality, integrity, and availability of the WordPress installation if the escalation succeeds.