CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and including, 5.0.3. This makes it possible for unauthenticated attackers to retrieve sensitive user metadata, including password hashes.
Explanation of Vulnerability in Simple Terms
The Post Grid Gutenberg Blocks plugin for WordPress does not properly check user permissions before allowing access to sensitive data. An unauthenticated attacker can read information that should be restricted, such as unpublished posts or private content. This affects all versions up to 5.0.3. Site administrators should update to a version newer than 5.0.3 as soon as it becomes available.
What an attacker can do
Read restricted post data and private content without logging in.
Potential impact on your site
Unpublished drafts, private posts, and other restricted content may be exposed to the public.
Conditions required to exploit
None. The attacker needs only network access; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
