The PostX WordPress plugin suffers from a missing capability check (CWE-862) in the 'install_required_plugin_callback' function, enabling authenticated users with low privileges (Subscriber and above) to install and activate arbitrary plugins. This flaw can be exploited to escalate privileges and potentially achieve remote code execution if combined with other vulnerable plugins. The vulnerability affects all versions up to 4.1.16 and has a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and the vulnerability is not related to a cloud service.

An attacker with Subscriber-level access or higher can bypass authorization controls to install and activate arbitrary plugins. This unauthorized capability can lead to remote code execution if the attacker installs a vulnerable plugin or leverages existing plugin vulnerabilities. The impact includes full compromise of the WordPress site, affecting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and avoid granting Subscriber or higher privileges to untrusted accounts. Monitor for updates from the PostX plugin vendor and apply patches promptly once available.