CVE-2024-8253: Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation
Vulnerability summary
CVE-2024-8253 is a high (CVSS 8.8) Incorrect Privilege Assignment vulnerability in pickplugins post_grid. EPSS estimates a 9.37% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities.
Timeline
- 11-09-2024PublishedVulnerability first disclosed.
- 11-09-2024Last modifiedVulnerability information updated.
Description
The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta to become an administrator.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
9.37%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 9.37% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pickplugins2 products
- post_grid≥ 2.2.87, < 2.2.91
- post grid and gutenberg blocks≥ 2.2.87, ≤ 2.2.90
Wordpress1 product
- post-grid≥ 2.2.87, ≤ 2.2.90 (fixed in 2.2.91)
2 vendors · 3 products