PT-2021-16166 · WordPress · Postx – Gutenberg Blocks For Post Grid

Apple502J · Published 2021-09-27 · Updated 2021-11-05 · CVE-2021-24652

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PostX – Gutenberg Blocks for Post Grid WordPress plugin versions prior to 2.4.10

Description The issue arises from incorrect checks before allowing logged-in users to perform certain AJAX-based requests. This allows any user to modify, delete, or add ultp options values.

Recommendations For versions prior to 2.4.10, update to version 2.4.10 or later to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-24652

Affected Products

Postx – Gutenberg Blocks For Post Grid

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-24652 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24652 · Vendor Advisory
• https://wpscan.com/vulnerability/5375bd3e-a30d-4f24-9b17-470b28a8231c · Note