CVE-2024-10728: PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'installrequiredplugincallback' function in all versions up to, and including, 4.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10728?
The severity of CVE-2024-10728 is considered to be high due to the potential for unauthorized plugin installations.
How do I fix CVE-2024-10728?
To fix CVE-2024-10728, upgrade the PostX plugin to version 4.1.17 or later, which includes a capability check for plugin installations.
Which versions of PostX are affected by CVE-2024-10728?
CVE-2024-10728 affects all versions of the PostX plugin up to and including 4.1.16.
Can CVE-2024-10728 be exploited remotely?
Yes, CVE-2024-10728 can be exploited remotely if an attacker gains access to the WordPress site's plugin installation capabilities.
Is there a patch available for CVE-2024-10728?
Yes, a patch is available in the updated version of the PostX plugin released after 4.1.16.