The PostX plugin contains an SSRF flaw in the /ultp/v3/starter_dummy_post/ and /ultp/v3/starter_import_content/ REST API endpoints. Compromised or malicious administrators can invoke these endpoints to request any URL, enabling the application to access internal or external resources. The vulnerability is a classic issuance of a server‑side request forgery weakness (CWE‑918) and can lead to data exfiltration or modification of internal services when the application is used in an enterprise or multi‑tier environment.

WordPress sites running the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin version 5.0.8 or earlier are affected. The flaw exists in all releases up to and including 5.0.8.

The CVSS score of 7.2 indicates a high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated administrator account; once the attacker gains access, they can direct the plugin to query or alter data on any accessible network resource via crafted URLs. The attack vector is inferred to be internal or remote web requests originating from the affected WordPress instance.