What the vulnerability does
01Description
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Explanation of Vulnerability in Simple Terms
02Summary
The Post Grid Gutenberg Blocks plugin for WordPress does not properly check user permissions before allowing access to certain administrative functions. A logged-in user with low privileges can perform actions normally restricted to administrators, including modifying site content and settings. All versions up to 4.1.2 are affected.
What an attacker can do
03Attacker Capabilities
A low-privilege logged-in user can perform administrative actions like modifying content, settings, and site configuration.
Potential impact on your site
04Site Impact
Unauthorized users can modify or delete posts, change plugin settings, and compromise site integrity without admin approval.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 30, 2024
CVE published
April 8, 2026
Record updated
