CVE-2024-5326
HIGHPost Grid Gutenberg Blocks & WordPress Blog Plugin - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-5326. PoCs published by cve-2024, djayaGit.
AI-analyzed exploit summary This PoC exploits a missing authorization check in the PostX WordPress plugin (CVE-2024-5326) to enable user registration and set the default role to Administrator. It requires Contributor-level credentials to modify arbitrary options via the 'postx_presets_callback' function.
Description
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Exploits (2)
This PoC exploits a missing authorization check in the PostX WordPress plugin (CVE-2024-5326) to enable user registration and set the default role to Administrator. It requires Contributor-level credentials to modify arbitrary options via the 'postx_presets_callback' function.
This PoC exploits a missing authorization check in the PostX WordPress plugin (CVE-2024-5326) to enable user registration and set the default role to Administrator. It requires Contributor-level credentials to modify arbitrary options via the 'postx_presets_callback' function.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H