CVE-2026-2518

MediumCVSS 4.3

Published: 22/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The FastX theme for WordPress up to version 1.0.2 lacks capability checks in the 'ultp_install_callback' and 'ultp_activate_callback' functions, allowing authenticated attackers with subscriber-level access to install and activate the PostX plugin.

Risk Assessment

Attackers can install and activate unauthorized plugins, potentially leading to site compromise.

Recommendation

Update the FastX theme to the latest patched version.

Other vulnerabilities in FastX

CVE-2025-57563Medium
A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files. An attacker can manipulate paths to access files outside the intended directory.

Original NVD description (English source)

The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the PostX plugin.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS