CVE-2021-24652: 
WordPress vulnerability analysis and mitigation

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before version 2.4.10 contains a security vulnerability identified as CVE-2021-24652. The vulnerability was discovered by researcher apple502j and was publicly disclosed on August 17, 2021. This security issue affects the WordPress plugin 'ultimate-post' and involves incorrect access control implementations (WPScan).

The vulnerability is classified as an Access Control issue (CWE-284) with a CVSS score of 4.3 (medium severity). The core issue lies in the plugin's improper implementation of access controls for ajax-based requests, which fails to properly validate user permissions. This vulnerability specifically affects the handling of ultp_options values (WPScan).

When exploited, this vulnerability allows any authenticated user to modify, delete, or add ultp_options values in the WordPress installation, regardless of their permission level. This represents a significant privilege escalation issue as lower-privileged users can perform actions typically reserved for administrators (WPScan).

The vulnerability has been fixed in version 2.4.10 of the PostX – Gutenberg Blocks for Post Grid plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).