PostX WordPress Plugin Missing Authorization Vulnerability Allows Unauthenticated Data Access

A vulnerability exists in the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress, in all versions through 5.0.3. The issue arises from a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint, allowing unauthenticated attackers to access sensitive user metadata, including password hashes.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, such as password hashes, which could be used for further attacks, like password cracking or unauthorized account access.

Remediation

Users are advised to update the PostX WordPress plugin to version 5.0.4 or a newer patched version.