CVE-2024-11080

Name of the Vulnerable Software and Affected Versions ComboBlocks versions 2.2.32 through 2.3.1

Description The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the ~/includes/blocks/form-wrap/function.php file, allowing unauthenticated attackers to execute actions using WordPress hooks, provided no other security controls are present in the function.

Recommendations Update ComboBlocks to a version later than 2.3.1. As a temporary mitigation, restrict access to the ~/includes/blocks/form-wrap/function.php file.