Vulnerability · Published Feb 22, 2025 · Assigned by Wordfence
CVE-2024-13798Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation
Medium 5.3
In plain English
A medium-severity improper input validation in Post Grid from pickplugins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for products and mark them as paid without actually completing a payment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pickplugins | Post Grid | 0 – through 2.3.5 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N