CVE-2026-2518 describes a missing authorization vulnerability in the FastX WordPress theme by wpxpo. The issue arises because the 'ultp_install_callback' and 'ultp_activate_callback' functions lack proper capability checks, allowing authenticated users with Subscriber-level privileges or higher to install and activate the PostX plugin. This unauthorized plugin installation and activation could lead to limited integrity impact. The vulnerability affects all versions up to and including 1.0.2. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation has been documented.

The vulnerability allows authenticated users with Subscriber-level access or higher to install and activate a plugin (PostX) without proper authorization checks. This could lead to unauthorized modification of the WordPress environment, impacting integrity. There is no impact on confidentiality or availability reported. The medium CVSS score reflects the limited but valid integrity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict Subscriber-level access and above to trusted users only. Monitoring for unauthorized plugin installations may help detect exploitation attempts.