What the vulnerability does
01Description
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
02Summary
The Post Grid Gutenberg Blocks plugin for WordPress contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the site send HTTP requests to internal or external systems on their behalf. An attacker can exploit this to access internal services, retrieve sensitive data, or interact with external APIs without authorization. The vulnerability affects all versions up to 5.0.8.
What an attacker can do
03Attacker Capabilities
Make the site send HTTP requests to internal systems or external URLs to retrieve data or perform actions.
Potential impact on your site
04Site Impact
Attackers can access internal services, retrieve sensitive information, or abuse your site's network position to attack other systems.
Conditions required to exploit
05Prerequisites
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
06Disclosure timeline
March 4, 2026
CVE published
April 8, 2026
Record updated
