CVE-2024-0881

medium · 5.4

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts

5.4

CVSS

16.9%

EPSS (exploit prob.)

97th

EPSS percentile

2024-04-11

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Vendor	Product	Affected versions
pickplugins	post_grid	< 2.2.76

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/e460e926-6e9b-4e9f-b908-ba5c9c7fb290/
https://wpscan.com/vulnerability/e460e926-6e9b-4e9f-b908-ba5c9c7fb290/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-0881