CVE-2023-7072: Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'getposts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft posts and password protected posts, as well as the password for password-protected posts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7072?
CVE-2023-7072 is classified as a moderate severity vulnerability due to its potential for sensitive information exposure.
How do I fix CVE-2023-7072?
To remediate CVE-2023-7072, update the Post Grid Combo plugin to version 2.2.69 or later.
Who is affected by CVE-2023-7072?
All versions of the Post Grid Combo plugin for WordPress up to and including version 2.2.68 are affected by CVE-2023-7072.
What type of vulnerability is CVE-2023-7072?
CVE-2023-7072 is a vulnerability that leads to sensitive information exposure through the 'get_posts' REST API endpoint.
What data can be exposed due to CVE-2023-7072?
CVE-2023-7072 can allow unauthenticated attackers to access sensitive data, including full draft posts.