Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
Priority MEDIUM 58Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.16906 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel (Unknown): 2.2.76
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel | before 2.2.76 | 2.2.76 | Patch available | CNA |
- Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel VendorUnknown Affected before 2.2.76 Fixed in 2.2.76 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:* | before 2.2.76 | Vulnerable | PickPlugins |
- cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:* Versions before 2.2.76 Vulnerable ·PickPlugins
Remediation
- Fix · CNA Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel (Unknown) Fixed in 2.2.76
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0881
- 2026-10-03 Alias added: GHSA-73jw-m44p-r46h
References
More PickPlugins Post Grid vulnerabilities
- TI-2024-08948 Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-07651 Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2020-18382 PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for… CVSS 3.1HIGH 8.8
- TI-2020-18381 PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress… CVSS 3.1HIGH 8.8
- TI-2024-12450 Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor… CVSS 3.1HIGH 8.8
- TI-2021-03306 Post Grid <= 2.1.12 - Contributor+ SQL Injection CVSS 3.1HIGH 8.8
Sources
- CVE-2024-0881 · CVE Program
- CVE-2024-0881 · NVD
- FIRST EPSS
- GHSA-73jw-m44p-r46h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences