CVE-2024-5326

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.

• CWE-862

• https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Styles.php#L160
• https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Styles.php#L177
• https://plugins.trac.wordpress.org/changeset/3093815/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07a3db33-3787-4b63-835d-8e3026206842?source=cve
• https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Styles.php#L160
• https://plugins.trac.wordpress.org/browser/ultimate-post/trunk/classes/Styles.php#L177
• https://plugins.trac.wordpress.org/changeset/3093815/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07a3db33-3787-4b63-835d-8e3026206842?source=cve

Published

May 30, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53254Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2024-53255BoidCMS is a free and open-source flat file CMS for building…5.4
• CVE-2024-53256Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2024-53257Vitess is a database clustering system for horizontal scalin…4.9
• CVE-2024-53258Autolab is a course management service that enables auto-gra…5.3
• CVE-2024-53259quic-go is an implementation of the QUIC protocol in Go. An …6.5
• CVE-2024-53260Autolab is a course management service that enables auto-gra…6.8
• CVE-2024-53261SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53262SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53263Git LFS is a Git extension for versioning large files. When …8.5
• CVE-2024-53264bunkerweb is an Open-source and next-generation Web Applicat…5.1
• CVE-2024-53266Discourse is an open source platform for community discussio…5.4