Kadence Blocks Pro < 2.3.8 – Contributor+ Arbitrary Option Access | CVE 2024-1330 | Plugin Vulnerabilities

Description

The plugin does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.

Proof of Concept

1. ADMIN: Install Kadence Blocks Pro
2. CONTRIBUTOR: Add shortcode to any post and specify/guess the option name and save
3. CONTRIBUTOR: Preview the post and see option you shouldn't have access to

Example shortcode: `[kb-dynamic para="kb_custom_input" custom="active_plugins" field="site|custom_setting"]`

Affects Plugins

kadence-blocks-pro

Fixed in 2.3.8

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Scott Kingsley Clark

Submitter

Scott Kingsley Clark

Submitter website

https://skc.dev

Submitter twitter

Verified

Yes

WPVDB ID

1988815b-7a53-4657-9b1c-1f83c9f9ccfd

Timeline

Publicly Published

2024-06-06 (about 1 year ago)

Added

2024-06-06 (about 1 year ago)

Last Updated

2025-08-22 (about 4 months ago)

Other

Published

Title

Published

2024-07-25

Title

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

Published

2024-04-10

Title

GP Unique ID < 1.5.6 - Unauthenticated Form Submission Unique ID Modification

Published

2025-03-12

Title

Business Directory Plugin - Easy Listing Directories for WordPress < 6.4.15 - Insecure Direct Object Reference to Listing Arbitrary Image Addition

Published

2025-02-06

Title

Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosure

Published

2021-03-17

Title

BuddyPress < 7.2.1 - Invite Member to Join Group