WordPress Plugin Vulnerabilities

Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.22 - Unauthenticated Hook Injection

Description

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.85 to 2.3.22 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

Affects Plugins

Plugin icon
post-grid
Fixed in 2.3.23

References

CVE
CVE-2024-11080
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8666d4-042e-4cf4-86f5-474a69d90ff6

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Chloe Chamberland
Verified
No
WPVDB ID
c2a6a419-cf90-4d73-bd1f-d9b2e3a94c46

Timeline

Publicly Published
2026-09-04 (about 15 days ago)
Added
2026-09-04 (about 15 days ago)
Last Updated
2026-09-10 (about 9 days ago)

Other

Published
Title
Published
2025-04-23
Title
Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution
Published
2026-01-21
Title
Beaver Builder < 2.9.4.2 - Contributor+ Remote Code Execution
Published
2014-08-01
Title
File Gallery 1.7.9 - Settings Page create_function Function Remote Comm& Execution
Published
2026-07-22
Title
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… < 3.9.0 - Authenticated (Subscriber+) Remote Code Execution
Published
2024-12-28
Title
Ninja Forms < 3.8.23 - Subscriber+ Arbitrary Shortcode Execution