CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including, 5.0.5. This makes it possible for unauthenticated attackers to modify the share_count post meta for any post, including private or draft posts.
Explanation of Vulnerability in Simple Terms
The Post Grid Gutenberg Blocks plugin for WordPress does not properly check user permissions before allowing modifications to post grid settings and content. An attacker can modify post grid configurations and data without authentication. This affects all versions up to 5.0.5. Site administrators should update to a version newer than 5.0.5 when available.
What an attacker can do
Modify post grid settings and content without logging in to the site.
Potential impact on your site
Unauthorized users can alter how posts are displayed and potentially inject malicious content into post grids.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
