CVE-2024-11080
Received Received - Intake

Unauthenticated Hook Injection in ComboBlocks WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Wordfence

Description
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2024-11080
EUVD
EUVD-2024-55751

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpcomb the_post_grid From 2.2.32 (inc) to 2.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Unauthenticated Hook Injection in the Post Grid and Gutenberg Blocks – ComboBlocks WordPress plugin. It affects versions 2.2.32 to 2.3.1 and is located in the ~/includes/blocks/form-wrap/function.php file. Unauthenticated attackers can exploit this to execute WordPress actions via hooks if no other security controls are present in the affected functions.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary actions on your WordPress site. This could lead to unauthorized changes, data theft, or complete site compromise if exploited. The high CVSS score (9.8) indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face fines or penalties if exploited due to inadequate security measures.

Mitigation Strategies

Update the Post Grid and Gutenberg Blocks – ComboBlocks plugin to the latest version immediately to patch the vulnerability. If updating is not possible, consider disabling or removing the plugin until a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-11080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart