Unauthenticated Hook Injection in Post Grid and Gutenberg Blocks Plugin for WordPress
CVE-2024-11080

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Post Grid
Vendor
CVE Published:
5 September 2026

What is CVE-2024-11080?

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit hook injection. This issue resides in specific functions found in the ~/includes/blocks/form-wrap/functions.php file, specifically in versions 2.2.32 through 2.3.1. The vulnerability enables malicious individuals to execute unauthorized actions if no additional security measures are in place within the affected functions. This can lead to severe consequences in a WordPress environment, highlighting the importance of applying necessary security updates and practices.

Affected Version(s)

Post Grid 2.2.85 <= 2.3.32

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/post-grid/trun...
https://plugins.trac.wordpress.org/browser/post-grid/trun...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
.