CVE-2024-10728

🗓️ 16 Nov 2024 04:29:15Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Missing Authorization in Wpxpo Postx	16 Nov 202410:51	–	githubexploit
Circl	CVE-2024-10728	16 Nov 202406:52	–	circl
CNNVD	WordPress plugin PostX 安全漏洞	16 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-10728 PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation	16 Nov 202404:29	–	cvelist
NVD	CVE-2024-10728	16 Nov 202405:15	–	nvd
OSV	CVE-2024-10728	16 Nov 202405:15	–	osv
Patchstack	WordPress PostX Plugin <= 4.1.16 is vulnerable to Broken Access Control	18 Nov 202400:00	–	patchstack
Patchstack	WordPress PostX plugin <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation vulnerability	18 Nov 202407:29	–	patchstack
Positive Technologies	PT-2024-16490 · WordPress · Postx	15 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-10728	5 Feb 202504:59	–	redhatcve

NVD

Vulners

Vulnrichment

Node

wpxpo postxRange<4.1.17wordpress

[
  {
    "vendor": "wpxpo",
    "product": "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.1.16",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/ultimate-post/tags/4.1.16/classes/Importer.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/076f36fb-c2fb-43e0-a027-1351d3995489
plugins	www.plugins.trac.wordpress.org/browser/ultimate-post/tags/4.1.16/classes/Initialization.php
wordpress	www.wordpress.org/plugins/ultimate-post/
plugins	www.plugins.trac.wordpress.org/changeset/3188636/ultimate-post/trunk/classes/Importer.php

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Missing authorization on install_required_plugin in PostX <= 4.1.16 allowing authenticated users (Subscriber+) to install/activate arbitrary plugins via the AJAX endpoint.	CWE-862
wpnonce	request body	wp-admin/admin-ajax.php	Missing authorization on install_required_plugin in PostX <= 4.1.16 allowing authenticated users (Subscriber+) to install/activate arbitrary plugins via the AJAX endpoint.	CWE-862
plugin	request body	wp-admin/admin-ajax.php	Missing authorization on install_required_plugin in PostX <= 4.1.16 allowing authenticated users (Subscriber+) to install/activate arbitrary plugins via the AJAX endpoint.	CWE-862

08 Apr 2026 16:33Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

EPSS0.76069

SSVC

CWE-862