PT-2026-42722 · WordPress · Fastx+1

Itthidej Aramsri · Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-2518

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FastX theme for WordPress versions prior to 1.0.3

Description The FastX theme for WordPress allows authenticated attackers with Subscriber-level access or higher to install and activate the PostX plugin. This is caused by missing capability checks in the ultp install callback() and ultp activate callback() functions.

Recommendations Update to a version later than 1.0.2. As a temporary workaround, restrict access to the ultp install callback() and ultp activate callback() functions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2518

Affected Products

Fastx

Postx

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2518 · Security Note
• https://themes.trac.wordpress.org/browser/fastx/1.0.2/classes/Initialization.php#L264 · Note
• https://twitter.com/CVEnew/status/2057783174684455250 · Twitter Post
• https://themes.trac.wordpress.org/browser/fastx/1.0.2/classes/Initialization.php#L249 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6f5c4194-4f97-4f85-af90-e983ba9ce3a6?source=cve · Note