{"id":"CVE-2021-24652","aliases":["EUVD-2021-11564","GHSA-9758-6rv3-3xpp"],"status":"published","title":"PostX Gutenberg Blocks for Post Grid \u003c 2.4.10 - Missing Access Controls","description":"The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00716,"percentile":0.54092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2021-09-27T15:25:30Z","modified":"2026-06-17T03:40:23Z","products":[{"vendor":"post grid team by wpxpo","product":"postx – gutenberg blocks for post grid"},{"vendor":"unknown","product":"postx – gutenberg blocks for post grid"},{"vendor":"wpxpo","product":"postx_-_gutenberg_blocks_for_post_grid"}],"references":[{"url":"https://wpscan.com/vulnerability/5375bd3e-a30d-4f24-9b17-470b28a8231c","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24652"},{"url":"https://github.com/advisories/GHSA-9758-6rv3-3xpp"}],"sources":{"cve":[{"id":"CVE-2021-24652","title":"PostX Gutenberg Blocks for Post Grid \u003c 2.4.10 - Missing Access Controls","description":"The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.","status":"published","published":"2021-09-27T15:25:30Z","modified":"2024-08-03T19:35:20.368Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11564","description":"The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.","status":"published","published":"2021-09-27T15:25:30Z","modified":"2024-08-03T19:35:20Z","updated_at":"2026-11-03T03:24:56.857735Z"}],"ghsa":[{"id":"GHSA-9758-6rv3-3xpp","title":"The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect...","description":"The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.","status":"published","published":"2022-05-24T22:28:28Z","modified":"2023-01-30T05:05:30Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:47:17.774737Z"}],"nvd":[{"id":"CVE-2021-24652","description":"The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.","status":"published","published":"2021-09-27T16:15:08.9Z","modified":"2026-06-17T03:40:23.707Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:58.933037Z"}]}}