Platform
wordpress
Component
post-grid
Fixed in
2.3.4
CVE-2024-9636 represents a critical privilege escalation vulnerability discovered in the Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress. This flaw allows unauthenticated attackers to register on a WordPress site with administrator privileges, granting them complete control over the system. The vulnerability impacts versions 2.2.85 through 2.3.3, and a patch is available from the vendor.
The impact of CVE-2024-9636 is severe. Successful exploitation allows an attacker to bypass authentication entirely and gain administrator access to the WordPress site. This grants them the ability to modify any content, install malicious plugins or themes, steal sensitive data (user credentials, financial information, customer data), and potentially compromise the entire server infrastructure. The attacker could also use the compromised site to launch further attacks against other systems or users. This vulnerability is particularly concerning given the widespread use of WordPress and the plugin's popularity.
CVE-2024-9636 was publicly disclosed on 2025-01-15. No public proof-of-concept (POC) code has been released at the time of writing, but the vulnerability's ease of exploitation suggests it is likely to be targeted. The high CVSS score indicates a significant risk, and it is prudent to assume active exploitation is possible. This vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.76% (73% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-9636 is to immediately upgrade the ComboBlocks plugin to a patched version. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling user registration to prevent new administrator accounts from being created. While not a complete solution, implementing strict user role restrictions and regularly auditing user accounts can help limit the potential damage. Monitor WordPress logs for suspicious registration attempts.
Update the Post Grid and Gutenberg Blocks plugin to the latest available version. This will fix the privilege escalation vulnerability that allows unauthenticated users to register as administrators.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-9636 is a critical vulnerability allowing unauthenticated attackers to register as administrators in ComboBlocks WordPress plugin versions 2.2.85–2.3.3 due to improper user meta restrictions.
If you are using ComboBlocks plugin versions 2.2.85 through 2.3.3, you are potentially affected by this vulnerability. Check your plugin version immediately.
Upgrade the ComboBlocks plugin to the latest available version. If upgrading is not possible, temporarily disable user registration until the upgrade can be performed.
While no public exploits are currently available, the vulnerability's ease of exploitation suggests it is likely to be targeted. Proactive mitigation is recommended.
Refer to the ComboBlocks plugin website or WordPress.org plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.