CVE-2024-0881: Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
First published: Thu Apr 11 2024(Updated: )
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Credit: contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Combo Blocks | <2.2.76 | |
| WordPress Post Grid | <2.2.76 | |
| WordPress Form Maker | <2.2.76 | |
| WordPress Popup Maker | <2.2.76 | |
| WooCommerce Blocks | <2.2.76 | |
| WordPress Post Blocks | <2.2.76 | |
| WordPress Post Carousel | <2.2.76 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-0881?
CVE-2024-0881 is considered to have a medium severity due to improper authorization that exposes password-protected posts.
How do I fix CVE-2024-0881?
To fix CVE-2024-0881, update the affected WordPress plugins to version 2.2.76 or later.
Which WordPress plugins are affected by CVE-2024-0881?
CVE-2024-0881 affects the Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, and Post Carousel plugins prior to version 2.2.76.
What is the impact of CVE-2024-0881?
The impact of CVE-2024-0881 allows unauthorized users to view content from password-protected posts through certain unauthenticated AJAX actions.
Can I downgrade my plugins to resolve CVE-2024-0881?
No, downgrading will not resolve CVE-2024-0881; it is essential to upgrade to the latest plugin versions to ensure security.
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/combo
- canonical/combo blocks
- vendor/wordpress
- canonical/wordpress post grid
- canonical/wordpress form maker
- canonical/wordpress popup maker
- canonical/woocommerce blocks
- canonical/wordpress post blocks
- canonical/wordpress post carousel