Description
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including, 5.0.5. This makes it possible for unauthenticated attackers to modify the share_count post meta for any post, including private or draft posts.
Published: 2026-04-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification of post meta data by unauthenticated users
Action: Patch Now
AI Analysis

Impact

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin contains a missing capability check (CWE‑862) in the ultp_shareCount_callback() function, allowing any attacker to alter the share_count post meta of any post, including private or draft ones. This flaw compromises data integrity and can be used to manipulate engagement metrics.

Affected Systems

WordPress users of the "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX" plugin, with all versions up to and including 5.0.5, are affected. Updates beyond 5.0.5 are presumed to contain the fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. EPSS information is unavailable and the issue is not listed in the CISA KEV catalog, so the likelihood of exploitation is unknown but potentially significant given the unauthenticated nature of the attack vector. Exploitation would involve sending crafted requests to the plugin’s callback endpoint from an external source, requiring no special privileges.

Generated by OpenCVE AI on April 17, 2026 at 03:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin to version 5.0.6 or later, which addresses the missing authorization check.
  • If an immediate upgrade is not possible, disable the share count functionality or prevent public access to the ultp_shareCount_callback endpoint by either deactivating the plugin or restricting access through server configuration.
  • Monitor WordPress logs for unusual activity involving the ultp_shareCount_callback endpoint to detect potential exploitation attempts.

Generated by OpenCVE AI on April 17, 2026 at 03:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Apr 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpxpo
Wpxpo post Grid Gutenberg Blocks For News, Magazines, Blog Websites – Postx
Vendors & Products Wordpress
Wordpress wordpress
Wpxpo
Wpxpo post Grid Gutenberg Blocks For News, Magazines, Blog Websites – Postx

Thu, 16 Apr 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including, 5.0.5. This makes it possible for unauthenticated attackers to modify the share_count post meta for any post, including private or draft posts.
Title Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
Wpxpo Post Grid Gutenberg Blocks For News, Magazines, Blog Websites – Postx
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-16T12:55:16.326Z

Reserved: 2026-01-08T12:11:07.838Z

Link: CVE-2026-0718

cve-icon Vulnrichment

Updated: 2026-04-16T12:55:13.026Z

cve-icon NVD

Status : Received

Published: 2026-04-16T08:16:27.170

Modified: 2026-04-16T08:16:27.170

Link: CVE-2026-0718

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T03:30:08Z

Weaknesses