PT-2024-16637 · WordPress · The Grid Plus

Arkadiusz Hydzik · Published 2024-12-12 · Updated 2024-12-12 · CVE-2024-10910

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The Grid Plus – Unlimited grid layout plugin for WordPress versions up to, and including, 1.3.5

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes via the "grid plus load by category" AJAX action. This is due to the software permitting users to execute an action that does not properly validate a value before running do shortcode.

Recommendations For versions up to, and including, 1.3.5, consider disabling the grid plus load by category AJAX action until a patch is available. Restrict access to the do shortcode function to minimize the risk of exploitation. Avoid using the grid plus load by category action in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-10910

Affected Products

The Grid Plus

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-10910 · Security Note
• https://t.me/latest_high_impact_cve/1635 · Telegram Post
• https://twitter.com/CVEnew/status/1867171914252181657 · Twitter Post
• https://t.me/cvenotify/103980 · Telegram Post
• https://plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.5/core/ajax_fe.php#L19 · Note
• https://wordpress.org/plugins/grid-plus/#developers · Note
• https://t.me/cvedetector/12720 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/266032a8-a139-4a14-8eda-8be7a66357df?source=cve · Note