High 7.2Published Mar 3, 2026

CVE-2026-1273PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints

Updated under an hour ago (Oct 26, 2026, 11:50 PM ET)

Does this affect you?

It affects wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX

Exploited in the last 30 days

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVSS: 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Wordfence
NVD analysis: Deferred
Record last updated: Apr 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX wpxpo:post_grid_gutenberg_blocks_for_news_magazines_blog_websites_postx (from the name)	through 5.0.8	CNA record

References

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/afe6d4ac-1712-415e-9995-cb7c8fe4e1a0?source=cve
https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L196
https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L196
https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Importer.php#L261
https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.5/classes/Importer.php#L261
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3469409%40ultimate-post&new=3469409%40ultimate-post&sfp_email=&sfph_mail=

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.