CVE-2024-0881
published 2024-04-11CVE-2024-0881: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization…
PriorityP347medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EXPLOIT
EPSS
16.91%
96.7th percentile
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pickplugins | post_grid | < 2.2.76 | 2.2.76 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Combo Blocks < 2.2.76 - Improper Access Control
nuclei·CVSS 5.4
CVE-2024-0881 [MEDIUM] Combo Blocks < 2.2.76 - Improper Access Control
Combo Blocks < 2.2.76 - Improper Access Control
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Template:
id: CVE-2024-0881
info:
name: Combo Blocks < 2.2.76 - Improper Access Control
author: s4e-io
severity: medium
description: |
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
impact: |
Unauthenticated attackers can access
No writeups or analysis indexed.
2024-04-11
Published