PT-2025-9053 · WordPress · Comboblocks

Wesley · Published 2025-02-28 · Updated 2025-02-28 · CVE-2024-13796

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress versions prior to 2.3.7

Description The issue allows unauthenticated attackers to extract sensitive data, including emails and other user data, via the "/wp-json/post-grid/v2/get users" API endpoint.

Recommendations For versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13796

Affected Products

Comboblocks

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13796 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13796 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3245187%40post-grid&new=3245187%40post-grid&sfp_email=&sfph_mail= · Patch
• https://twitter.com/VulmonFeeds/status/1895429001084084282 · Twitter Post
• https://t.me/cvedetector/19121 · Telegram Post
• https://t.me/cvenotify/112749 · Telegram Post
• https://twitter.com/CVEnew/status/1895619349953884617 · Twitter Post
• https://plugins.trac.wordpress.org/browser/post-grid/trunk/includes/blocks/functions-rest.php?rev=3242718#L2055 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0407223a-cd41-43d1-87b0-d6b83b57d4b3?source=cve · Note