Critical severity · published Jan 15, 2025
CVE-2024-9636
Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Post Grid and Gutenberg Blocks – ComboBlocks · pickplugins
2.2.85 through 2.3.3 · source: vendor
Affected product
PG
Post Grid and Gutenberg Blocks – ComboBlocks
pickplugins
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9636
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/post-grid/tags/2.2.93/includes/blocks/form-wrap/functions.php#L3200
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3117675/post-grid/trunk/includes/blocks/form-wrap/functions.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3221012/post-grid/trunk/includes/blocks/form-wrap/functions.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/1bbe01b8-24ed-4e1e-bafc-0f4dea96c1f3?source=cve