CVE-2025-54751 HIGH

CVE-2025-54751: WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability

Vendor Wpxpo

Product PostX

Weakness CWE-862 · Missing authorization

Published December 18, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 4.1.36.

Explanation of Vulnerability in Simple Terms

02Summary

PostX versions up to 4.1.36 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can change data belonging to other users or restricted areas of the site. The vulnerability requires a valid login but no special interaction from victims.

What an attacker can do

03Attacker Capabilities

Modify or alter content and data belonging to other users or restricted site areas.

Potential impact on your site

04Site Impact

Any registered user can alter posts, settings, or data they should not be able to edit, risking data integrity and unauthorized changes.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges on the site.

Key dates

06Disclosure timeline

December 18, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-54751 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities