Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure

This research plan outlines the steps to investigate and exploit CVE-2025-12980, a missing authorization vulnerability in the PostX (ultimate-post) plugin. This vulnerability allows unauthenticated attackers to access sensitive user data, including password hashes, via a specific REST API endpoint.

---

1. Vulnerability Summary

• Vulnerability: Missing Authorization to Unauthenticated Sensitive Information Exposure.
• Affected Plugin: Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX (slug: ultimate-post).
• Vulnerable Versions: <= 5.0.3.
• Vulnerable Endpoint: /wp-json/ultp/v2/get_dynamic_content/.
• Root Cause: The REST API route ultp/v2/get_dynamic_content/ lacks a proper permission_callback (likely set to __return_true or missing entirely), allowing unauthenticated users to trigger functions that retrieve user data without filtering sensitive fields like user_pass.

2. Attack Vector Analysis

• Endpoint: /wp-json/ultp/v2/get_dynamic_content/
• HTTP Method: POST (typical for Gutenberg dynamic fetching).
• Parameters (Inferred):
  • content_type: Likely specifies what to fetch (e.g., 'user', 'author', or 'post').
  • id or object_id: The ID of the user/post to fetch.
  • attributes or settings: Configuration for which fields to return.
• Authentication: None required (Unauthenticated).
• Preconditions: The REST API must be enabled (default in WordPress).

3. Code Flow (Inferred)

1. Route Registration: The plugin registers the route using register_rest_route in the rest_api_init hook.
   • File: Likely includes/classes/class-ultp-rest-api.php or similar.
   • Code: register_rest_route( 'ultp/v2', '/get_dynamic_content/', ... ).
2. Missing Check: The permission_callback for this route is either absent or returns true for all users.
3. Data Retrieval: The callback function (likely get_dynamic_content) receives the POST parameters. It uses these to call functions like get_userdata() or get_user_meta().
4. Information Leak: The function returns the resulting object directly in the REST response without sanitizing the user_pass field or restricted user_meta keys.

4. Nonce Acquisition Strategy

While REST API routes with permission_callback => '__return_true' often don't strictly require the wp_rest nonce for GET requests, POST requests in WordPress usually require a nonce if the user is authenticated, or the plugin might check a custom nonce for consistency.

1. Identify Shortcode: PostX uses Gutenberg blocks. Create a page with a PostX block (e.g., a "Post Grid" or "Author" block).
2. Create Test Page:

   wp post create --post_type=page --post_title="PostX Test" --post_status=publish --post_content='<!-- wp:ultimate-post/post-grid /-->'
   

3. Navigate and Extract:
   Use the browser_navigate tool to the new page. Use browser_eval to find localized data.
   • Search for: ultp_ajax_obj, postx_obj, or ultp_settings.
   • JavaScript: window.ultp_ajax_obj?.nonce or window.postx_localize?.rest_nonce.
4. Manual Check: If no nonce is found, the endpoint might be entirely unprotected.

5. Exploitation Strategy

Step 1: Discover Parameters
Since the exact parameter structure is inferred, first attempt to trigger an error or a successful response with a minimal payload to the endpoint.

Step 2: Craft Payload
Attempt to retrieve user ID 1 (typically the admin).

• Request URL: http://localhost:8080/wp-json/ultp/v2/get_dynamic_content/
• Headers: Content-Type: application/json
• Payload (Inferred Candidate A):

  {
      "content_type": "user",
      "object_id": 1
  }
  

• Payload (Inferred Candidate B - based on PostX "Dynamic Data" feature):

  {
      "source": "user",
      "id": 1,
      "field": "all"
  }
  

Step 3: Execute HTTP Request
Use the http_request tool to send the POST request.

6. Test Data Setup

1. Ensure PostX is active: wp plugin activate ultimate-post.
2. Create a Target User: Ensure there is a user with a known ID.

   wp user create victim victim@example.com --user_pass=Password123! --role=administrator
   

3. Identify User ID:

   wp user list --field=ID --user_login=victim
   

7. Expected Results

• Success: A 200 OK response with a JSON object.
• Sensitive Data: The JSON body should contain a key like user_pass or data containing a string starting with $P$ or $wpb$ (the WordPress password hash). It may also expose user_email and user_activation_key.

8. Verification Steps

After receiving the REST response:

1. Compare Hash: Use WP-CLI to get the actual hash and verify it matches the leaked one.

   wp db query "SELECT user_pass FROM wp_users WHERE ID = 1"
   

2. Check Meta: If metadata was leaked, verify it against:

   wp user meta list 1
   

9. Alternative Approaches

If the get_dynamic_content endpoint requires specific "Block Settings" to be passed:

1. Examine Source: Look for render_dynamic_content or get_dynamic_content in the plugin folder (/wp-content/plugins/ultimate-post/) to see how it parses $request->get_params().
2. Interception: If a page with a PostX block is loaded in the browser, check the "Network" tab in Playwright/Chrome to see if any requests are automatically made to /ultp/v2/get_dynamic_content/ and copy that request's structure.
3. Varying Content Types: Try content_type values like author, current_user, or user_meta.