LiveActive security incident?Get immediate response
CVE Record

CVE-2024-11080: Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in the WordPress Post Grid/ComboBlocks plugin may let an unauthenticated internet user trigger WordPress hooks. Because those hooks could perform powerful actions, successful abuse may compromise site data, integrity, or availability. The supplied records disagree on affected versions, so installed versions require vendor-confirmed assessment.

Executive priority

Treat as an urgent investigation and remediation item for public WordPress sites. Prioritize asset discovery and temporary isolation because the potential impact is critical and authentication is unnecessary. Do not claim compromise or active exploitation without site evidence; the supplied sources do not support either conclusion.

Technical view

CVE-2024-11080 is classified as CWE-94 and CVSS 9.8. Insufficient controls in form-wrap functions reportedly permit unauthenticated hook injection, enabling attacker-selected WordPress actions where no additional safeguards intervene. The bundle inconsistently identifies versions 2.2.32–2.3.1, 2.2.85–2.3.32, and an affected entry listing only 2.2.85 as default-unaffected.

Likely exposure

Internet-facing WordPress sites running Post Grid/ComboBlocks may be exposed when affected form functionality is reachable without authentication. Actual exposure depends on the installed version, enabled features, available hooks, and compensating controls. The contradictory version data prevents a definitive affected-range determination from this bundle.

Exploitation context

The vulnerability is remotely reachable, requires no privileges or user interaction, and is scored for potentially high confidentiality, integrity, and availability impact. The bundle reports no CISA KEV listing and provides no evidence of active exploitation. Public source references identify relevant code locations but do not establish observed attacks.

Researcher notes

The principal uncertainty is version scope: the title, description, and structured affected entry conflict. Validate against the current CVE record, Wordfence entry, plugin changelog, and source history before declaring a host vulnerable or remediated. The cited Trac locations support code review, but the bundle does not identify a fixed version or demonstrate exploitability in every configuration.

Mitigation direction

  • Inventory all WordPress sites using Post Grid or ComboBlocks and record exact plugin versions.
  • Check current vendor and Wordfence guidance to resolve the conflicting affected-version ranges.
  • Update to a vendor-confirmed fixed release when one is identified.
  • Disable the plugin or affected functionality until remediation is confirmed if exposure cannot be excluded.
  • Preserve backups and relevant logs before making production changes.

Validation and detection

  • Confirm the installed plugin package, version, and whether form-wrap functionality is enabled.
  • Compare each installation against current vendor-confirmed affected and fixed versions.
  • Verify unauthenticated users cannot invoke privileged or unintended WordPress hook actions.
  • Review web and WordPress logs for suspicious unauthenticated requests targeting affected functionality.
  • Retest affected functionality after updating or disabling the plugin.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-11080 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Wordfence

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2024-11080Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineWordfence

    Vendor Notified

  3. Source timelineWordfence

    Disclosed

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
pickpluginsPost Grid2.2.85unaffected
Weakness

CWE details

CWE-94

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-94 · source CWE mapping

Improper Control of Generation of Code ('Code Injection')

Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs