Executive brief
ComboBlocks is a popular WordPress plugin that provides post grid and Gutenberg block functionality for building dynamic page layouts. The plugin contains an unauthenticated hook injection vulnerability that allows attackers to execute arbitrary WordPress actions without authentication, potentially leading to unauthorized modifications, data exposure, or site compromise depending on which hooks are exploited.
Technical details
The vulnerability is a hook injection flaw in the form-wrap module (~/includes/blocks/form-wrap/function.php) of ComboBlocks versions 2.2.32 through 2.3.1. The affected functions fail to properly validate or restrict hook execution, allowing unauthenticated attackers to invoke WordPress action hooks that would normally require authentication. The attack is network-reachable and requires no user interaction beyond crafting a malicious request. An attacker can execute arbitrary actions through the WordPress hook system, the impact of which depends on hooks registered by the site or other plugins. A patch is expected in versions after 2.3.1.
Affected products
- ComboBlocks ComboBlocks 2.2.32 to 2.3.1
Timeline
- 2024-09-05: disclosed
- 2024-09-05: kev added: CVE-2024-11080