The PostX WordPress plugin suffers from a missing capability check (CWE-862) in the 'postx_presets_callback' function, which is responsible for handling certain plugin options. Because of this flaw, authenticated users with Contributor or higher privileges can alter plugin settings without proper authorization. This includes enabling new user registrations and assigning the Administrator role by default to new users, which could allow privilege escalation and unauthorized administrative control over the site. The vulnerability affects all versions up to and including 4.1.2. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

An attacker with Contributor-level access or higher can exploit this vulnerability to modify plugin options arbitrarily, including enabling new user registrations and setting the default role for new users to Administrator. This can lead to unauthorized creation of administrative accounts, resulting in full site compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Monitor for plugin updates from the vendor and apply them promptly once released. Avoid enabling new user registrations unless necessary and review user roles regularly to detect unauthorized privilege escalations.