Unauthenticated Arbitrary Shortcode Execution Vulnerability in The Grid Plus

CVE-2024-10910

Summary

The Grid Plus plugin for WordPress has a vulnerability that allows arbitrary shortcode execution through the grid_plus_load_by_category AJAX action. This issue affects all versions up to and including 1.3.5. The lack of proper validation before executing the do_shortcode function creates an opportunity for unauthenticated attackers to execute malicious shortcodes. This vulnerability poses a significant security risk, as it can be exploited by anyone without authentication, possibly leading to unauthorized actions within the affected WordPress sites. Users are advised to review the plugin's security settings and consider updating to the latest version to mitigate this vulnerability.

References