FastX WordPress Theme Missing Authorization Vulnerability Allows Unauthorized Plugin Installation and Activation

A vulnerability exists in the FastX theme for WordPress, in all versions through 1.0.2, that allows unauthorized limited plugin installation and activation. This issue arises from inadequate capability checks in the 'ultp_install_callback' and 'ultp_activate_callback' functions. As a result, authenticated attackers with Subscriber-level access or higher can install and activate the PostX plugin.

Impact

Exploitation of this vulnerability could lead to unauthorized installation and activation of plugins, potentially allowing for malicious plugins to be used in the WordPress site.