CVE-2024-11080: Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection
Vulnerability summary
CVE-2024-11080 is a critical (CVSS 9.8) Code Injection vulnerability in pickplugins post_grid. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities.
Timeline
- 05-09-2026PublishedVulnerability first disclosed.
- 07-09-2026Last modifiedVulnerability information updated.
Description
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.44% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pickplugins1 product
- post_grid≥ 2.2.85, ≤ 2.3.32
Wordpress1 product
- post-grid≥ 2.2.85, ≤ 2.3.22 (fixed in 2.3.23)
2 vendors · 2 products