The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX WordPress plugin contains a missing authorization vulnerability (CWE-862) in the ultp_shareCount_callback() function. This flaw permits unauthenticated users to modify the share_count post meta for any post, including private or draft posts, due to the absence of a capability check. The vulnerability affects all versions up to 5.0.5. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact limited to modification, and no availability impact. No patch or official fix has been confirmed by the vendor or advisory sources.

An attacker without authentication can modify the share_count metadata of any post, including private or draft posts. This impacts the integrity of post metadata but does not affect confidentiality or availability. There are no known exploits in the wild. The vulnerability could lead to misleading or manipulated share count information displayed on affected websites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's functionality or disabling it if feasible. Monitor official vendor channels for updates and apply patches promptly once available.