CVE-2024-0881

Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

Medium · published April 11, 2024

CVSS v3.1

5.4

EPSS

17%

Percentile

97.0

In the wild

Unconfirmed

What it is

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.16906 · 97.0th percentile
Published: 2024-04-11T15:36Z

EPSS history

Timeline

11 APR 15:36Z
Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
cvelistv5