PT-2025-9171 · WordPress · Generateblocks

Nirmal + 1 · Published 2025-03-01 · Updated 2025-03-02 · CVE-2024-13546

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GenerateBlocks plugin for WordPress versions prior to 1.9.2

Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including the content of private, draft, and scheduled posts and pages, via the get image description function.

Recommendations For versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the get image description function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13546

Affected Products

Generateblocks

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13546 · Security Note
• https://twitter.com/CVEnew/status/1895981985329528846 · Twitter Post
• https://t.me/cvenotify/112984 · Telegram Post
• https://t.me/cvedetector/19229 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1896089732615901549 · Twitter Post
• https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-dynamic-content.php#L1054 · Note
• https://plugins.trac.wordpress.org/changeset/3239461 · Note
• https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-dynamic-content.php#L1047 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4f6f2a8c-ecd9-482c-a32e-0c3d7a7e4ec4?source=cve · Note