CVE-2024-13798CWE-20

Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation

Medium · published February 22, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for products and mark them as paid without actually completing a payment.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00334 · 25.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-02-22T04:21Z
EPSS history
Timeline
  • 22 FEB 04:21Z
    Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation
    cvelistv5