CVE-2026-49054

Vulnerability

The Post Grid plugin for WordPress versions through 7.9.2 contains a missing authorization vulnerability. The plugin fails to properly verify access control levels, allowing unauthenticated or low-privileged users to perform actions intended for higher-privileged users. [1]

Exploitation

An attacker can exploit this by sending crafted requests to the vulnerable endpoint without proper authentication or nonce checks. No prior authentication may be required, depending on the specific function affected. [1]

Impact

Successful exploitation could allow an attacker to access or modify sensitive data, or execute administrative actions, leading to partial loss of confidentiality, integrity, or availability. Given the nature of mass-exploit campaigns, the impact can affect many sites.

Mitigation

Users should update to a patched version if available; as of the advisory, no fixed version is mentioned beyond 7.9.2 being affected. As immediate action, update the plugin or disable it until a fix is applied. [1]