CVE-2026-1273

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1273", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T21:52:14.169Z", "datePublished": "2026-03-04T01:21:59.242Z", "dateUpdated": "2026-04-08T17:15:42.749Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:42.749Z"}, "affected": [{"vendor": "wpxpo", "product": "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afe6d4ac-1712-415e-9995-cb7c8fe4e1a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L196"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L196"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L261"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L261"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3469409%40ultimate-post&new=3469409%40ultimate-post&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Mohammad Amin Hajian"}, {"lang": "en", "type": "finder", "value": "Pouria Shahba"}], "timeline": [{"time": "2026-01-20T22:07:22.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-03T12:22:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T16:05:48.497284Z", "id": "CVE-2026-1273", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:05:57.662Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1273", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T16:05:48.497284Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T16:05:53.852Z"}}], "cna": {"title": "PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints", "credits": [{"lang": "en", "type": "finder", "value": "Mohammad Amin Hajian"}, {"lang": "en", "type": "finder", "value": "Pouria Shahba"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpxpo", "product": "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.0.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-20T22:07:22.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-03T12:22:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afe6d4ac-1712-415e-9995-cb7c8fe4e1a0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L196"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L196"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L261"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L261"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3469409%40ultimate-post&new=3469409%40ultimate-post&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-04T01:21:59.242Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1273", "state": "PUBLISHED", "dateUpdated": "2026-03-04T16:05:57.662Z", "dateReserved": "2026-01-20T21:52:14.169Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-04T01:21:59.242Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX", "vendor": "wpxpo", "versions": [{"lessThanOrEqual": "5.0.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Post Grid Gutenberg Blocks para News, Magazines, Blog Websites \u2013 PostX para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 5.0.8, inclusive, a trav\u00e9s de los endpoints de la API REST '/ultp/v3/starter_dummy_post/' y '/ultp/v3/starter_import_content/'. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede ser utilizado para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2026-1273", "lastModified": "2026-06-17T10:15:25.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1273", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T16:05:48.497284Z", "version": "2.0.3"}}]}, "published": "2026-03-04T02:15:53.573", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L196"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L261"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L196"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L261"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3469409%40ultimate-post&new=3469409%40ultimate-post&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/afe6d4ac-1712-415e-9995-cb7c8fe4e1a0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX", "source": "cna", "vendor": "wpxpo"}, "product": "post_grid_gutenberg_blocks_for_news,_magazines,_blog_websites_\u2013_postx", "vendor": "wpxpo"}], "analysis": {"en": {"generated_at": "2026-04-15T17:57:30.699838+00:00", "value": {"mitigation_remediation": ["Upgrade the PostX plugin to the latest version (5.0.9 or newer if available).", "Restrict the /ultp/v3/starter_dummy_post/ and /ultp/v3/starter_import_content/ endpoints to trusted IP addresses or disable them for non\u2011administrator users.", "Block outbound traffic from the WordPress instance to untrusted external addresses or implement firewall rules that restrict the plugin\u2019s ability to make arbitrary network requests."], "summary": {"action": "Patch Immediately", "impact": "Server\u2011Side Request Forgery (SSRF) permitting authenticated administrators to initiate requests to arbitrary URLs from the WordPress site"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX plugin version 5.0.8 or earlier are affected. The flaw exists in all releases up to and including 5.0.8.", "description_and_impact": "The PostX plugin contains an SSRF flaw in the /ultp/v3/starter_dummy_post/ and /ultp/v3/starter_import_content/ REST API endpoints. Compromised or malicious administrators can invoke these endpoints to request any URL, enabling the application to access internal or external resources. The vulnerability is a classic issuance of a server\u2011side request forgery weakness (CWE\u2011918) and can lead to data exfiltration or modification of internal services when the application is used in an enterprise or multi\u2011tier environment.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated administrator account; once the attacker gains access, they can direct the plugin to query or alter data on any accessible network resource via crafted URLs. The attack vector is inferred to be internal or remote web requests originating from the affected WordPress instance."}}}}, "created": "2026-03-04T14:53:24.698417+00:00", "updated": "2026-04-15T18:00:15.505659+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpxpo", "wpxpo$PRODUCT$post_grid_gutenberg_blocks_for_news,_magazines,_blog_websites_\u2013_postx"]}