CVE-2024-10728

The PostX WordPress plugin (Post Grid Gutenberg Blocks and WordPress Blog Plugin by WPXPO) fails to enforce a capability check on its 'install_required_plugin_callback' function in all versions up to and including 4.1.16 (CWE-862, missing authorization), leaving that callback open to any logged-in user. Any authenticated attacker with Subscriber-level access or higher can send a request to this callback to install and activate arbitrary WordPress plugins. Because activating a second, separately vulnerable plugin can be leveraged for remote code execution, a low-privilege account can be escalated toward full site compromise, which is reflected in the 8.8 High CVSS score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Any WordPress site running PostX 4.1.16 or earlier is affected, with sites that allow visitor self-registration or maintain many low-privilege user accounts being most exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but the 38.2% EPSS score (98th percentile) indicates a high probability of exploitation within the next 30 days.

What to do: Update the PostX plugin to the latest release, meaning any version above 4.1.16. Until patched, audit the installed and activated plugin list for anything unexpected and consider restricting subscriber self-registration or disabling PostX if it is not actively used. After updating, review low-privilege user accounts and recently activated plugins, since exploitation via this flaw could have enabled remote code execution on the site.