Executive brief
The FastX theme for WordPress contains a security flaw that allows low-level users, such as subscribers, to perform administrative actions they should not have access to. Specifically, an attacker can remotely install and activate the PostX plugin without proper authorization. While this does not directly expose sensitive data, it allows unauthorized changes to the website's configuration and active software.
Technical details
The FastX theme for WordPress (versions up to 1.0.2) fails to implement proper authorization checks (CWE-862) on two specific functions: 'ultp_install_callback' and 'ultp_activate_callback'. These functions are responsible for the installation and activation of the PostX plugin. Because of the missing capability checks, any authenticated user with at least Subscriber-level permissions can trigger these functions via a network request. This allows an attacker to force the installation and activation of the PostX plugin on the target site. The vulnerability is addressed by ensuring proper 'manage_options' or similar capability checks are performed before executing plugin management tasks.
Affected products
- FastX FastX Theme Up to, and including, 1.0.2
Timeline
- 2026-05-22: disclosed: Vulnerability published to the CVE list.
- 2026-05-22: advisory: Wordfence published a security advisory.