CVE-2025-12980 identifies a missing authorization vulnerability in the Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX WordPress plugin. Specifically, the REST API endpoint '/ultp/v2/get_dynamic_content/' does not perform capability checks, allowing unauthenticated users to retrieve sensitive user metadata such as password hashes. This affects all versions up to and including 5.0.3. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5 (Network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality impact, no integrity or availability impact). No patch or official fix has been documented in the provided data.

An unauthenticated attacker can exploit this vulnerability to access sensitive user metadata, including password hashes, potentially leading to user credential compromise. The confidentiality of user data is severely impacted, but integrity and availability are not affected. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoint if possible, and monitor for any updates from the vendor or security advisories. Avoid exposing the affected plugin on publicly accessible WordPress installations without additional access controls.