Vulnerability · Published Apr 11, 2024 · Assigned by WPScan
CVE-2024-0881Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
Medium 5.4
In plain English
A medium-severity security flaw in Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 16.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)16.9%top 2.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel | 0 – before 2.2.76 |
References
- https://wpscan.com/vulnerability/e460e926-6e9b-4e9f-b908-ba5c9c7fb290/ exploit, vdb-entry, technical-description