What is the CVSS score of CVE-2026-0718?

CVE-2026-0718 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-0718

EUVD-2026-23201 MEDIUM

Missing Authorization (CWE-862)

2026-04-16 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 08:24 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 08:00 euvd

EUVD-2026-23201

Analysis Generated

Apr 16, 2026 - 08:00 vuln.today

CVE Published

Apr 16, 2026 - 07:39 nvd

MEDIUM 5.3

DescriptionCVE.org

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including, 5.0.5. This makes it possible for unauthenticated attackers to modify the share_count post meta for any post, including private or draft posts.

AnalysisAI

Unauthenticated attackers can modify post share count metadata in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX (PostX) plugin versions up to 5.0.5 due to a missing capability check in the ultp_shareCount_callback() function. This allows unauthorized modification of share_count post meta for any post including private and draft posts, affecting all WordPress installations running the vulnerable plugin. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability resides in the WordPress plugin PostX (cpe:2.3:a:wpxpo:post_grid_gutenberg_blocks_for_news,_magazines,_blog_websites_-_postx:*:*:*:*:*:*:*:*), which provides Gutenberg blocks for displaying posts in grid layouts. The root cause is CWE-862 (Missing Authorization), specifically the absence of WordPress capability checks on the ultp_shareCount_callback() AJAX callback function. WordPress AJAX handlers must verify that the invoking user possesses appropriate capabilities (permissions) via functions like current_user_can() before performing sensitive operations. The vulnerable function directly processes share count modifications without this authorization layer, allowing any network-accessible request-including those from unauthenticated users-to modify post metadata. This metadata is typically stored in WordPress's wp_postmeta table and can affect any post type and status.

RemediationAI

Upgrade immediately to Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX version 5.0.6 or later, which adds the missing capability check to the ultp_shareCount_callback() function. The fix is confirmed by the WordPress plugin repository changeset comparing version 5.0.5 to 5.0.6 at https://plugins.trac.wordpress.org/changeset?old_path=/ultimate-post/tags/5.0.5/classes/Blocks.php&new_path=/ultimate-post/tags/5.0.6/classes/Blocks.php. Update via the WordPress admin dashboard (Plugins > Installed Plugins) or via command line using wp plugin update ultimate-post. If immediate patching is not possible, restrict AJAX access by implementing Web Application Firewall (WAF) rules to block requests to the affected callback endpoint; consult your WordPress security plugin documentation for the specific AJAX action name (typically ultp_shareCount or similar) and block unauthenticated POST requests to wp-admin/admin-ajax.php containing that action parameter. Note that WAF filtering is a temporary measure and introduces risk of broken share count functionality if rules are overly broad; patching is the only reliable remediation.