The Post Grid and Gutenberg Blocks – ComboBlocks (2.2.32-2.3.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/the-post-grid-and-gutenberg-blocks--comboblocks-2.2.32-2.3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 05 Sep 2026 09:30:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Hook Injection in The Post Grid and Gutenberg Blocks Pluginhttps://feed.craftedsignal.io/briefs/2026-09-cve-2024-11080/Sat, 05 Sep 2026 09:30:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2024-11080/The Post Grid and Gutenberg Blocks - ComboBlocks plugin for WordPress contains an unauthenticated hook injection vulnerability in versions 2.2.32 to 2.3.1 that allows remote attackers to execute arbitrary actions via hook functions.The Post Grid and Gutenberg Blocks - ComboBlocks plugin for WordPress is affected by a critical vulnerability (CVE-2024-11080) that allows unauthenticated attackers to perform hook injection. The flaw exists within several functions located in the file ~/includes/blocks/form-wrap/function.php. By leveraging this vulnerability, an unauthenticated remote attacker can trigger WordPress hooks, which may result in unauthorized configuration modifications, data exfiltration, or further compromise of the WordPress site. The vulnerability affects plugin versions 2.2.32 through 2.3.1. Defenders should prioritize auditing web server access logs for anomalous POST requests directed at plugin-specific API or form-processing endpoints and upgrade the plugin to a patched version once available.

Impact

Successful exploitation allows unauthenticated attackers to execute unauthorized actions within the WordPress environment. This could lead to full site takeover, unauthorized administrative actions, or persistent backdoor installation. As this plugin is widely used for site building and block management, the potential for widespread impact on affected WordPress installations is high.

Recommendation

  • Audit WordPress site inventory to identify instances of 'The Post Grid and Gutenberg Blocks - ComboBlocks' plugin running versions 2.2.32 to 2.3.1.
  • Patch affected WordPress sites by updating to the latest plugin version released after 2.3.1.
  • Monitor web server logs for high-frequency or unusual POST requests targeting paths associated with the plugin's form-wrapping functionality.
]]>criticaladvisorywordpresscveweb-applicationinjection