Post Grid and Gutenberg Blocks Plugin Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- Post Grid and Gutenberg Blocks – ComboBlocks (wordpress)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Post Grid and Gutenberg Blocks ComboBlocks plugin for WordPress. Versions 2.2.32 to 2.3.1 are reportedly affected.
What happened
The Post Grid and Gutenberg Blocks ComboBlocks plugin for WordPress is under investigation for a critical vulnerability. Versions 2.2.32 to 2.3.1 appear to be vulnerable to Unauthenticated Hook Injection. This allows unauthenticated attackers to execute actions with hooks in WordPress if no other security controls are present. The vulnerability has a CVSS score of 9.8 indicating a critical severity level. The issue has been tracked under CVE-2024-11080.
To assess your exposure, check if your WordPress site is running any of the affected versions of the Post Grid and Gutenberg Blocks ComboBlocks plugin. If so, it is recommended to upgrade to the latest version of the plugin as soon as possible. Additionally, review any custom hooks for potential security issues.
What to do about it
- Upgrade to the latest version of the Post Grid and Gutenberg Blocks ComboBlocks plugin.
- Review any custom hooks for potential security issues.
- Implement additional security controls to mitigate the risk of unauthenticated hook injection.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
How 0Day would have caught this
Post Grid and Gutenberg Blocks – ComboBlocks is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your WordPress site is running any version of the Post Grid and Gutenberg Blocks ComboBlocks plugin between 2.2.32 and 2.3.1.
What should I do right now?
Upgrade to the latest version of the Post Grid and Gutenberg Blocks ComboBlocks plugin and review any custom hooks for potential security issues.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.