CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L116
https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L262
https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L3249
https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8666d4-042e-4cf4-86f5-474a69d90ff6?source=cve

Configurations

No configuration.

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) El plugin Post Grid and Gutenberg Blocks - ComboBlocks para WordPress es vulnerable a la inyección de hooks no autenticada en las versiones 2.2.32 a la 2.3.1 a través de varias funciones en el archivo ~/includes/blocks/form-wrap/function.php. Esto permite a atacantes no autenticados ejecutar acciones con hooks en WordPress, siempre que no haya otros controles de seguridad presentes en la función.

Information

Published : 2026-09-05 09:16

Updated : 2026-10-27 18:10

NVD link : CVE-2024-11080

Mitre link : CVE-2024-11080

CVE.ORG link : CVE-2024-11080

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-11080", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-11080", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-07T11:04:50.378533Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "pickplugins", "product": "Post Grid", "versions": [{"status": "affected", "version": "2.2.85", "versionType": "semver", "lessThanOrEqual": "2.3.32"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-05T09:16:48.880", "references": [{"url": "https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L116", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L262", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/form-wrap/functions.php#L3249", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8666d4-042e-4cf4-86f5-474a69d90ff6?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Post Grid and Gutenberg Blocks \u2013 ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function."}, {"lang": "es", "value": "El plugin Post Grid and Gutenberg Blocks - ComboBlocks para WordPress es vulnerable a la inyecci\u00f3n de hooks no autenticada en las versiones 2.2.32 a la 2.3.1 a trav\u00e9s de varias funciones en el archivo ~/includes/blocks/form-wrap/function.php. Esto permite a atacantes no autenticados ejecutar acciones con hooks en WordPress, siempre que no haya otros controles de seguridad presentes en la funci\u00f3n."}], "lastModified": "2026-10-27T18:10:00.130", "sourceIdentifier": "security@wordfence.com"}