CVE-2024-10728

Description

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and including, 4.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Reserved 2024-11-02 | Published 2024-11-16 | Updated 2024-11-19 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

*
affected

Timeline

2024-11-15:

Disclosed

Credits

Sean Murphy finder

References

www.wordfence.com/...-c2fb-43e0-a027-1351d3995489?source=cve

plugins.trac.wordpress.org/...gs/4.1.16/classes/Importer.php

plugins.trac.wordpress.org/....16/classes/Initialization.php

wordpress.org/plugins/ultimate-post/

plugins.trac.wordpress.org/...ost/trunk/classes/Importer.php

cve.org (CVE-2024-10728)

nvd.nist.gov (CVE-2024-10728)

Download JSON