What is the CVSS score of CVE-2026-2518?

CVE-2026-2518 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

FastX WordPress Theme CVE-2026-2518

EUVD-2026-31412 MEDIUM

Missing Authorization (CWE-862)

2026-05-22 Wordfence

GHSA-jjqp-72fq-xmqp

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:15 vuln.today

DescriptionCVE.org

The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the PostX plugin.

AnalysisAI

Missing authorization controls in the FastX WordPress theme allow authenticated Subscriber-level users to install and activate the PostX plugin without administrative approval. The vulnerability exists in two AJAX callback functions - 'ultp_install_callback' and 'ultp_activate_callback' - which fail to verify whether the requesting user holds sufficient capabilities before executing privileged plugin management operations. All versions up to and including 1.0.2 are affected per WPXPO's theme codebase on themes.trac.wordpress.org. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The FastX theme (CPE: cpe:2.3:a:wpxpo:fastx:*:*:*:*:*:*:*:*) is a WordPress theme developed by WPXPO. WordPress themes can register AJAX action hooks that are callable by any authenticated user unless guarded by capability checks such as current_user_can(). CWE-862 (Missing Authorization) describes exactly this pattern: privileged functionality is exposed via registered handlers that omit the authorization gate. In this case, the functions 'ultp_install_callback' and 'ultp_activate_callback' defined in classes/Initialization.php (lines 249 and 264 of version 1.0.2) allow any authenticated request - including those from the lowest default WordPress role (Subscriber) - to invoke WordPress plugin installation and activation routines. The PostX plugin, the specific target of these callbacks, is a companion product from the same vendor (WPXPO), suggesting the theme was designed to streamline PostX onboarding but the implementation skipped role validation.

RemediationAI

No vendor-released patched version has been confirmed from the available data; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6f5c4194-4f97-4f85-af90-e983ba9ce3a6 should be monitored for patch release announcements. Site administrators using FastX theme should check the WordPress theme update channel for a version newer than 1.0.2 and apply it immediately once available. As a compensating control until a patch is released, administrators should audit all Subscriber-level and above accounts and remove any untrusted or unnecessary low-privilege users, since exploitation requires at least Subscriber authentication. Additionally, web application firewall rules can be configured to block unauthenticated and low-privilege requests to the admin-ajax.php actions associated with 'ultp_install_callback' and 'ultp_activate_callback' - though this may interfere with legitimate theme onboarding flows if PostX installation is intended. Disabling the FastX theme entirely and switching to an alternative is the most definitive workaround if the site does not depend on it.