ByteOS Network

CVE Vulnerability Details :

CVE-2026-1273

PUBLISHED

More Info Official Page

Assigner-Wordfence

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-04 Mar, 2026 | 01:21

Updated At-04 Mar, 2026 | 01:21

▼CVE Numbering Authority (CNA)

PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected Products

Vendor

wpxpo

Product

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX

Default Status

unaffected

Versions

Affected

From * through 5.0.8 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-918	CWE-918 Server-Side Request Forgery (SSRF)

Type: CWE

CWE ID: CWE-918

Description: CWE-918 Server-Side Request Forgery (SSRF)

Metrics

Version	Base score	Base severity	Vector
3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Credits

finder

Mohammad Amin Hajian

finder

Pouria Shahba

Timeline

Event	Date
Vendor Notified	2026-01-20 22:07:22
Disclosed	2026-03-03 12:22:12

Event: Vendor Notified

Date: 2026-01-20 22:07:22

Event: Disclosed

Date: 2026-03-03 12:22:12

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/afe6d4ac-1712-415e-9995-cb7c8fe4e1a0?source=cve	N/A
https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L196	N/A
https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L196	N/A
https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L261	N/A
https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L261	N/A
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3469409%40ultimate-post&new=3469409%40ultimate-post&sfp_email=&sfph_mail=	N/A