CVE-2024-5326: Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postxpresetscallback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin – Post Grid Gutenberg Blocks and WordPress Blog Plugin (PostX)to a version that resolves this vulnerability.Fixed in 4.1.2 - Compensating control
Prevent Contributor-level (and above) users from being able to reach the vulnerable functionality; restrict access to the WordPress plugin’s affected request/endpoint so only authorized administrators can perform preset/options updates.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5326?
CVE-2024-5326 is considered a high-severity vulnerability due to unauthorized data modification risks.
How do I fix CVE-2024-5326?
To fix CVE-2024-5326, update the PostX plugin to the latest version beyond 4.1.2.
What versions of PostX are affected by CVE-2024-5326?
CVE-2024-5326 affects all versions of the PostX plugin up to and including 4.1.2.
What impact does CVE-2024-5326 have on WordPress sites?
CVE-2024-5326 could allow unauthorized users to modify site data, jeopardizing site integrity.
Is there a workaround for CVE-2024-5326?
Currently, the best workaround for CVE-2024-5326 is to disable the PostX plugin until it is updated.