PT-2026-86366
CVE-2024-11080
·
تاريخ النشر
2026-09-04
·
تاريخ التحديث
2026-09-06
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ComboBlocks versions 2.2.32 through 2.3.1
Description
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the
~/includes/blocks/form-wrap/function.php file, allowing unauthenticated attackers to execute actions using WordPress hooks, provided no other security controls are present in the function.Recommendations
Update ComboBlocks to a version later than 2.3.1.
As a temporary mitigation, restrict access to the
~/includes/blocks/form-wrap/function.php file. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾