PT-2024-15886 · WordPress · Vg Postcarousel+5

Krzysztof Zając · Published 2024-04-11 · Updated 2025-05-09 · CVE-2024-0881

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin versions prior to 2.2.76

Description The issue concerns improper authorization in the WordPress plugin, allowing unauthenticated users to read password-protected posts through certain unauthenticated AJAX actions. This results in unauthorized access to sensitive information.

Recommendations For versions prior to 2.2.76, update to version 2.2.76 or later to resolve the issue. As a temporary workaround, consider restricting access to password-protected posts or disabling the affected AJAX actions until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2024-0881

Affected Products

Form Maker

Popup Maker

Post Blocks

Vg Postcarousel

The Post Grid

Woocommerce Blocks

References · 6

• 🔥 https://wpscan.com/vulnerability/e460e926-6e9b-4e9f-b908-ba5c9c7fb290 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0881 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0881 · Vendor Advisory
• https://t.me/cvenotify/121588 · Telegram Post
• https://t.me/cvenotify/92802 · Telegram Post
• https://t.me/cvenotify/76547 · Telegram Post