CVE-2026-1273: WordPress PostX Plugin SSRF Vulnerability

CVE-2026-1273 Overview

CVE-2026-1273 is a Server-Side Request Forgery (SSRF) vulnerability in The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress. The flaw affects all versions up to and including 5.0.8. Attackers can abuse the /ultp/v3/starter_dummy_post/ and /ultp/v3/starter_import_content/ REST API endpoints to issue outbound HTTP requests from the WordPress server to arbitrary destinations. Exploitation requires authenticated access at the Administrator role or higher. The issue is tracked under [CWE-918].

Critical Impact
Authenticated administrators can force the WordPress server to query and modify internal services that should not be reachable from the public internet, including cloud metadata endpoints and internal management interfaces.

Affected Products

PostX – The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites plugin for WordPress
All versions through 5.0.8
WordPress installations running the vulnerable plugin with Administrator-level users exposed to compromise

Discovery Timeline

2026-03-04 - CVE-2026-1273 published to the National Vulnerability Database
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1273

Vulnerability Analysis

The vulnerability resides in the plugin's Importer.php class, specifically in the handlers for the /ultp/v3/starter_dummy_post/ and /ultp/v3/starter_import_content/ REST API endpoints. Both endpoints accept user-supplied URLs and pass them to server-side HTTP fetch routines without restricting the destination host or scheme. As a result, the WordPress server performs outbound HTTP requests on behalf of the attacker.

Because the request originates from the WordPress host, it bypasses perimeter network controls and can reach internal-only resources. Common SSRF abuse paths include cloud instance metadata services (such as 169.254.169.254), internal admin panels, database HTTP interfaces, and loopback services. Responses returned to the plugin can leak data back to the attacker, depending on how the importer processes fetched content.

Root Cause

The importer code at classes/Importer.php lines 196 and 261 invokes outbound HTTP fetches against attacker-controlled URLs without applying allowlists, host validation, or scheme restrictions. The endpoints rely solely on capability checks for authentication, treating any administrator as a fully trusted caller. No filtering prevents requests to private IP ranges or non-HTTP schemes.

Attack Vector

An attacker who has compromised or legitimately holds an Administrator account sends a crafted REST API request to one of the affected endpoints with a target URL parameter pointing at an internal resource. The WordPress server then issues the request and returns or processes the response. This makes the vulnerability useful as a pivot in multi-stage attacks where an administrator credential has been phished or stolen but lateral access to internal infrastructure is still required.

No public exploit or proof-of-concept code is currently listed for this CVE. Refer to the WordPress Plugin Importer Code and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-1273

Indicators of Compromise

Unexpected outbound HTTP requests from the WordPress server to RFC1918 addresses, link-local addresses (169.254.0.0/16), or 127.0.0.0/8.
WordPress access logs showing authenticated POST requests to /wp-json/ultp/v3/starter_dummy_post/ or /wp-json/ultp/v3/starter_import_content/ with external or internal URL parameters.
PHP error or debug logs referencing Importer.php with unusual remote hosts in fetch operations.

Detection Strategies

Inspect web server logs for REST API calls to the ultp/v3/starter_dummy_post and ultp/v3/starter_import_content endpoints and correlate with administrator session activity.
Monitor egress traffic from WordPress hosts for connections to cloud metadata endpoints or internal subnets that the application should not contact.
Alert on administrator accounts performing import or starter-site actions outside normal change windows.

Monitoring Recommendations

Forward WordPress, PHP-FPM, and reverse proxy logs to a centralized analytics platform for correlation across authentication and network events.
Baseline normal outbound destinations for the WordPress host and alert on deviations.
Track administrator-level REST API usage and flag bursts of importer endpoint calls.

How to Mitigate CVE-2026-1273

Immediate Actions Required

Update the PostX plugin to a version newer than 5.0.8 as soon as the vendor patch is available, referenced in the WordPress Plugin Changeset.
Audit all Administrator accounts, remove unused privileged users, and enforce multi-factor authentication on remaining accounts.
Review WordPress logs for prior calls to the affected REST endpoints originating from administrator sessions.

Patch Information

The vendor changeset 3469409 in the ultimate-post repository addresses the SSRF in the importer logic. Site operators should upgrade to the fixed release tracked through the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Workarounds

Deactivate the PostX plugin until it can be updated to a patched version.
Block egress from the WordPress host to internal management ranges and cloud metadata endpoints (169.254.169.254) at the network or host firewall.
Use a web application firewall rule to deny POST requests to /wp-json/ultp/v3/starter_dummy_post/ and /wp-json/ultp/v3/starter_import_content/ where the request body contains internal or non-HTTP URLs.

bash

# Example nginx rule to block access to the affected REST endpoints
location ~* /wp-json/ultp/v3/(starter_dummy_post|starter_import_content)/ {
    return 403;
}