Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX, CVE-2026-1273
- CVE, Research URL
- Home page URL
-
Security reports for Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX
- Published on
- Mar 04, 2026
- Research Description
- The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Affected versions
-
max 5.0.9.
- Status
-
vulnerable