PT-2025-10077 · WordPress · Vk Blocks

Nirmal + 1 · Published 2025-03-07 · Updated 2025-03-08 · CVE-2024-13635

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions VK Blocks plugin for WordPress versions up to, and including, 1.94.2.2

Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private posts and pages, via the page content block.

Recommendations For VK Blocks plugin for WordPress versions up to, and including, 1.94.2.2, update to a version that contains a fix for this issue to prevent sensitive information exposure.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-13635

Affected Products

Vk Blocks

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-13635 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3233455%40vk-blocks%2Ftrunk&old=3227170%40vk-blocks%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/cvedetector/19804 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1897994406256431600 · Twitter Post
• https://t.me/cvetracker/18667 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3233455/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php · Note
• https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php · Note
• https://t.me/cvenotify/113803 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cc03b3f4-2edb-463b-812b-6a187a7a893c?source=cve · Note
• https://twitter.com/CVEnew/status/1898246380193251636 · Twitter Post