CVE-2025-12980: 
WordPress vulnerability analysis and mitigation

CVE-2025-12980 is a Missing Authorization vulnerability in the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress, developed by wpxpo/RadiusTheme. The flaw allows unauthenticated attackers to retrieve sensitive user metadata, including password hashes, via an unprotected REST API endpoint. All plugin versions up to and including 5.0.3 are affected. The vulnerability was published on December 20–21, 2025, and was reported by Wordfence. It carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the /ultp/v2/get_dynamic_content/ REST API endpoint exposed by the PostX plugin. Because no authentication or authorization validation is enforced on this endpoint, any unauthenticated network request can query it and receive sensitive user metadata in the response. The fix was applied in the plugin's source code as documented in the WordPress plugin repository changeset (WordPress Changeset, Wordfence).

Successful exploitation allows unauthenticated remote attackers to retrieve sensitive WordPress user metadata, most critically password hashes, from any site running the vulnerable PostX plugin. Exposed password hashes can be subjected to offline cracking attacks, potentially enabling full account takeover of WordPress users including administrators. This represents a significant confidentiality breach with no integrity or availability impact directly, but compromised admin credentials could lead to complete site takeover and further lateral movement (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.001 (0.1%), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any attacker who can reach the WordPress REST API endpoint (Wordfence).

1. Reconnaissance: Identify WordPress sites running the PostX plugin (versions ≤ 5.0.3) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt or plugin metadata files.
2. Locate the vulnerable endpoint: Confirm the REST API endpoint /wp-json/ultp/v2/get_dynamic_content/ is accessible on the target site without authentication.
3. Send unauthenticated request: Issue an HTTP GET or POST request to the endpoint (e.g., curl https://target-site.com/wp-json/ultp/v2/get_dynamic_content/) without any authentication headers or cookies.
4. Extract sensitive metadata: Parse the API response to retrieve user metadata fields, including WordPress password hashes.
5. Offline hash cracking: Feed the extracted password hashes into a cracking tool such as Hashcat or John the Ripper using wordlists or brute-force techniques to recover plaintext passwords.
6. Account takeover: Use recovered credentials to log in to the WordPress admin panel or other services where the same credentials are reused (Wordfence, WordPress Changeset).

• Network: Unusual unauthenticated HTTP requests to /wp-json/ultp/v2/get_dynamic_content/ in web server access logs, especially from unfamiliar or automated IP addresses; high-frequency requests to this endpoint suggesting enumeration.
• Logs: WordPress access logs showing repeated GET or POST requests to the /ultp/v2/get_dynamic_content/ REST API route with no associated session cookies or authentication tokens; 200 OK responses to these unauthenticated requests.
• Authentication: Unexpected or anomalous WordPress admin login attempts or successful logins from new IP addresses or geolocations following exposure of the endpoint.

Update the PostX plugin to version 5.0.4 or later, which includes the fix adding proper capability checks to the /ultp/v2/get_dynamic_content/ REST API endpoint (WordPress Changeset). As an interim workaround, site administrators can restrict access to the WordPress REST API for unauthenticated users via a security plugin (e.g., Wordfence, iThemes Security) or web application firewall rules blocking unauthenticated access to /wp-json/ultp/ routes. Additionally, administrators should consider resetting WordPress user passwords as a precaution if the site was running a vulnerable version while publicly accessible (Wordfence).

Wordfence disclosed the vulnerability and published it in their threat intelligence database, noting it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Weekly Report). The vulnerability received routine coverage from automated security feeds and community accounts on Mastodon and Bluesky, with no notable researcher controversy or significant media coverage beyond standard vulnerability aggregation.