CVE-2026-0718: 
WordPress vulnerability analysis and mitigation

CVE-2026-0718 is a missing authorization vulnerability in the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress. Due to a missing capability check on the ultp_shareCount_callback() function, unauthenticated attackers can modify the share_count post meta for any post, including private or draft posts. All plugin versions up to and including 5.0.5 are affected. The vulnerability was published on April 16, 2026, with a patch available in version 5.0.6. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-862 (Missing Authorization): the ultp_shareCount_callback() function in classes/Blocks.php does not perform any capability or nonce check before processing requests, allowing any unauthenticated network request to invoke it. An attacker can send a crafted HTTP request directly to the WordPress AJAX or REST endpoint that triggers this callback, supplying an arbitrary post ID and share count value. No authentication, elevated privileges, or user interaction is required, making the attack trivially executable from the network. The code change between versions 5.0.5 and 5.0.6 is publicly visible in the WordPress plugin repository changeset (GitHub Advisory, WordPress Changeset).

Successful exploitation allows unauthenticated remote attackers to arbitrarily modify the share_count post metadata for any post on the affected WordPress site, including posts in private or draft status that should not be publicly accessible. The primary impact is on data integrity — engagement metrics displayed to users can be falsified, potentially undermining trust in the site's content. While there is no confidentiality or availability impact, the ability to interact with non-public post metadata could also serve as a reconnaissance vector or a stepping stone for further attacks through metadata manipulation (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the PostX plugin (version ≤ 5.0.5) using passive techniques such as checking publicly visible plugin metadata in page source or using tools like WPScan.
2. Identify the vulnerable endpoint: Locate the WordPress AJAX endpoint (typically wp-admin/admin-ajax.php) or the REST API route that maps to the ultp_shareCount_callback() function, which handles share count updates.
3. Craft the malicious request: Send an unauthenticated HTTP POST request to the identified endpoint with parameters specifying the target post ID and a desired (arbitrary) share_count value, without any authentication token or nonce.
4. Modify post metadata: Because no capability check is performed, the server processes the request and updates the share_count post meta in the WordPress database for the specified post, including private or draft posts.
5. Verify impact: Confirm the metadata change by observing updated share counts on the target post or by querying the WordPress database if further access is available (GitHub Advisory, WordPress Changeset).

• Network: Unusual or repeated unauthenticated HTTP POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the PostX plugin's share count callback, particularly from unexpected or automated source IPs.
• Logs: WordPress access logs showing requests to the share count callback action without valid authentication cookies or nonces; anomalous patterns of rapid or bulk requests targeting multiple post IDs.
• Database: Unexpected or inflated share_count values in the WordPress wp_postmeta table for posts, especially for private or draft posts that should not receive public engagement.

The vendor (wpxpo/RadiusTheme) has released version 5.0.6 of the PostX plugin, which implements proper capability checks on the ultp_shareCount_callback() function. All WordPress site administrators running PostX version 5.0.5 or earlier should update to version 5.0.6 or later immediately via the WordPress plugin dashboard. As an interim measure if patching is not immediately possible, deploying a Web Application Firewall (WAF) with rules to block unauthenticated requests to the vulnerable callback endpoint can reduce exposure (Wordfence, WordPress Changeset).

The vulnerability was reported and assigned by Wordfence, which published a threat intelligence entry for it. Coverage has been limited to automated vulnerability aggregators and security databases including ENISA EUVD, VulDB, and INCIBE, with no notable researcher commentary or significant community discussion observed beyond standard disclosure channels (Wordfence, GitHub Advisory).