CVE-2024-11080: Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The affected software is the WordPress ComboBlocks plugin. The description identifies versions 2.2.32 through 2.3.1 as vulnerable.
Does exploitation require an authenticated WordPress account or user interaction?
No. The issue is described as unauthenticated, and the supplied severity vector indicates no privileges and no user interaction are required.
What access could an attacker gain through this issue?
An attacker may be able to execute WordPress hook actions through vulnerable functions in the plugin's form-wrap code. Exploitation depends on there being no other security controls present in the relevant function.