{"id":"CVE-2026-125436","kind":"vulnerability","aliases":["CVE-2026-125436"],"related":[],"title":"The Post Grid WordPress plugin: missing authorization check lets users bypass access controls","description":"Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Post Grid: from n/a through 7.9.9.","summary":"The Post Grid, a WordPress plugin by Mamunur Rashid, has a missing authorization check tied to incorrectly configured access control levels. An attacker with low privileges may be able to perform actions they should not be allowed to perform.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"the-post-grid","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","the-post-grid","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed The Post Grid plugin version in the WordPress admin under Plugins, or with `wp plugin get the-post-grid --field=version`\n- Compare the installed version against the fixed release named in the sources (unknown)","fix":"- The Post Grid: unknown (sources state affected versions through `7.9.9` but no fixed version)","status":"open","published_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:49+00:00","updated_at":"2026-11-11T13:29:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:49Z","model":"claude-haiku-5-5","output":{"fix":"- The Post Grid: unknown (sources state affected versions through `7.9.9` but no fixed version)","reach":"internet","title":"The Post Grid WordPress plugin: missing authorization check lets users bypass access controls","impact":"medium","summary":"The Post Grid, a WordPress plugin by Mamunur Rashid, has a missing authorization check tied to incorrectly configured access control levels. An attacker with low privileges may be able to perform actions they should not be allowed to perform.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","the-post-grid"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may perform actions reserved for privileged roles","analyst_note":"Find the fixed version and the exact unauthorized action from the NVD entry or the plugin vendor's changelog.","how_to_check":"- Check the installed The Post Grid plugin version in the WordPress admin under Plugins, or with `wp plugin get the-post-grid --field=version`\n- Compare the installed version against the fixed release named in the sources (unknown)","plain_action":"","product_name":"the-post-grid","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running The Post Grid plugin up to and including version 7.9.9 are affected according to the NVD entry. The sources do not describe the exact configuration or role needed to trigger the flaw, so whether a given site is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000747,"input_tokens":4548,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125436':16A,19A '-2026':15A,18A '7.9.9':98C 'abl':58B 'access':12A,48B,86C 'action':61B 'affect':91C 'allow':66B,82C 'attack':52B 'author':7A,42B,70C 'bypass':11A 'check':8A,43B 'configur':47B,85C 'control':13A,49B,87C 'cve':14A,17A 'exploit':83C 'grid':3A,23A,28B,32B,77C,81C,94C 'incorrect':46B,84C 'issu':90C 'let':9A 'level':50B 'levels.this':89C 'low':54B 'mamunur':37B,73C 'may':56B 'miss':6A,41B,69C 'n/a':96C 'packag':24B 'perform':60B,68B 'plugin':5A,35B 'post':2A,22A,27B,31B,76C,80C,93C 'privileg':55B 'rashid':38B,74C 'secur':88C 'the':21A 'the-post-grid':20A,25B,78C 'tie':44B 'user':10A 'vulner':71C 'wordpress':4A,29B,34B","nicknames":[],"mitigations":[],"who_affected":"Sites running The Post Grid plugin up to and including version 7.9.9 are affected according to the NVD entry. The sources do not describe the exact configuration or role needed to trigger the flaw, so whether a given site is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["thepostgrid"],"ptokens":["grid","post","the"],"labels":["medium","package","thepostgrid","vendor","wordpress"],"campaign_type":null,"search_a":"'-125436':16A,19A '-2026':15A,18A 'access':12A 'author':7A 'bypass':11A 'check':8A 'control':13A 'cve':14A,17A 'grid':3A,23A 'let':9A 'miss':6A 'plugin':5A 'post':2A,22A 'the':21A 'the-post-grid':20A 'user':10A 'wordpress':4A","search_b":"'abl':58B 'access':48B 'action':61B 'allow':66B 'attack':52B 'author':42B 'check':43B 'configur':47B 'control':49B 'grid':28B,32B 'incorrect':46B 'level':50B 'low':54B 'mamunur':37B 'may':56B 'miss':41B 'packag':24B 'perform':60B,68B 'plugin':35B 'post':27B,31B 'privileg':55B 'rashid':38B 'the-post-grid':25B 'tie':44B 'wordpress':29B,34B","search_c":"'7.9.9':98C 'access':86C 'affect':91C 'allow':82C 'author':70C 'configur':85C 'control':87C 'exploit':83C 'grid':77C,81C,94C 'incorrect':84C 'issu':90C 'levels.this':89C 'mamunur':73C 'miss':69C 'n/a':96C 'post':76C,80C,93C 'rashid':74C 'secur':88C 'the-post-grid':78C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125436","severity":null,"published_at":"2026-11-11T13:17:21+00:00","modified_at":"2026-11-11T13:17:21+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}