CVE-2024-0881

Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts

Affected

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel

CVSS v3.1 CNA

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

16.91% chance of exploitation in the next 30 days, 97th percentile

Nuclei

medium · CWE-284

Published

2024-04-11

Updated

2024-10-31

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e460e926-6e9b-4e9f-b908-ba5c9c7fb290/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0881.yaml

Security advisories

• https://wpscan.com/vulnerability/e460e926-6e9b-4e9f-b908-ba5c9c7fb290

References

• CVE Record
• NVD entry