Vulnerability Description
The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/post-grid/tags/2.2.93/includes/blocks
- https://plugins.trac.wordpress.org/changeset/3117675/post-grid/trunk/includes/bl
- https://plugins.trac.wordpress.org/changeset/3221012/post-grid/trunk/includes/bl
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1bbe01b8-24ed-4e1e-baf
FAQ
What is CVE-2024-9636?
CVE-2024-9636 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be upda...
How severe is CVE-2024-9636?
CVE-2024-9636 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-9636?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.