PT-2024-38334 · WordPress · The Post Grid

Matthew Rollings + 1 · Published 2024-08-28 · Updated 2024-10-04 · CVE-2024-7418

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress versions up to, and including, 7.7.11

Description The issue allows authenticated attackers with contributor-level access and above to extract information from non-public posts, such as drafts and future posts, via the post query guten and post query functions. This makes it possible for attackers to access sensitive information.

Recommendations For versions up to, and including, 7.7.11, update to a version higher than 7.7.11 to mitigate the risk of sensitive information exposure. As a temporary workaround, consider restricting access to the post query guten and post query functions until a patch is available. Additionally, restrict contributor-level access and above to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-7418

Affected Products

The Post Grid

References · 12

• https://plugins.trac.wordpress.org/changeset/3142599/the-post-grid/trunk/app/Controllers/Blocks/BlockBase.php · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3142599%40the-post-grid&new=3142599%40the-post-grid&sfp_email=&sfph_mail= · Patch
• https://plugins.trac.wordpress.org/changeset/3142599/the-post-grid/trunk/app/Widgets/elementor/rtTPGElementorQuery.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7418 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7418 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/dddecb2e-9ad6-4e44-afce-5eba7da6322d?source=cve · Note
• https://twitter.com/oktsec/status/1828888854302007629 · Twitter Post
• https://t.me/cvenotify/97053 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1829153348295053777 · Twitter Post
• https://twitter.com/CVEnew/status/1829010659029188622 · Twitter Post
• https://t.me/cvedetector/4374 · Telegram Post
• https://twitter.com/CVESource/status/1829121993557360698 · Twitter Post