Medium severity · published Apr 11, 2024
CVE-2024-0881
Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
5.4
CVSS
16.9%
EPSS
No
On KEV
Description
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.9% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel ·
before 2.2.76 · source: vendor
PG
Post Grid · Pickplugins
before 2.2.76 · source: NVD, CISA
Affected product
PG
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel