CVE-2026-0718

BRIEFING NOTE The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites (PostX) WordPress plugin versions up to 5.0.5 contain a missing capability check vulnerability in the ultp_shareCount_callback() function that allows unauthenticated attackers to modify post metadata. This flaw enables unauthorized modification of share count data across all post types, including sensitive draft and private posts, without requiring authentication or user interaction. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with a network-based attack vector and low complexity, indicating accessible exploitation from the internet. While the impact is limited to data integrity with no confidentiality or availability impact, the ability to modify post metadata could facilitate reputational damage or post manipulation. The EPSS score of 0.00017 indicates extremely low exploitation prevalence in the wild, and the vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog. There is currently no evidence of active exploitation in the threat landscape, and the vulnerability is not listed on the Hot List for elevated monitoring. However, organizations running affected PostX plugin versions should prioritize patching to version 5.0.6 or later, particularly for publicly accessible WordPress installations hosting sensitive content that could be targeted by low-skill threat actors seeking to manipulate post metadata.