The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX WordPress plugin contains an SSRF vulnerability (CWE-918) in versions up to 5.0.8. The issue exists in the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints, allowing authenticated users with Administrator privileges to induce the server to send crafted requests to arbitrary locations. This can be leveraged to access or modify internal services that are otherwise inaccessible externally. The vulnerability is confirmed and published with a CVSS 3.1 score of 7.2, indicating high severity. There is no information about available patches or fixes from the vendor at this time.

An attacker with Administrator-level access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This can lead to unauthorized access or modification of internal service data, potentially compromising confidentiality and integrity within the affected environment. The vulnerability does not directly impact availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity involving the vulnerable REST API endpoints. Avoid exposing the affected endpoints unnecessarily. Follow vendor updates closely for any forthcoming patches or official mitigations.