Cyber & AI intelligence
Wasteland.
Briefs indexed2438
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2024-11080 2026-09-05

CVE-2024-11080: Unauthenticated Hook Injection in WordPress Post Grid and Gutenberg Blocks – ComboBlocks

"A critical (CVSS 9.8) flaw in the ComboBlocks / Post Grid plugin for WordPress lets unauthenticated attackers invoke WordPress hooks remotely, with high impact to confidentiality, integrity, and availability."

A critical (CVSS 9.8) flaw in the ComboBlocks / Post Grid plugin for WordPress lets unauthenticated attackers invoke WordPress hooks remotely, with high impact to confidentiality, integrity, and availability.

What Is It

CVE-2024-11080 is an Unauthenticated Hook Injection vulnerability in the "Post Grid and Gutenberg Blocks – ComboBlocks" plugin for WordPress. Per the NVD record, the flaw resides in several functions in ~/includes/blocks/form-wrap/function.php. The plugin exposes these code paths without authentication, making it possible for unauthenticated attackers to execute actions with hooks in WordPress; granted no other security controls are present in the function.

The weakness is classified as CWE-94 (Improper Control of Generation of Code). The advisory was issued by Wordfence ([email protected]) and published 2026-09-05, currently in NVD status "Received."

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability factor is at its worst: network-reachable, low attack complexity, no privileges required, and no user interaction. Exploitability subscore is 3.9, the maximum, and impact subscore is 5.9, with High ratings across confidentiality, integrity, and availability.

Because WordPress hooks are the mechanism through which plugin and core actions are dispatched, the ability to trigger arbitrary hooks from an unauthenticated position can translate into meaningful control over site behavior.

No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation and no KEV-mandated remediation deadline in the source material.

What's Vulnerable

The supplied data contains two differing version ranges, and both are reproduced here without reconciliation:

No CPE entries were provided. Administrators should treat any Post Grid / ComboBlocks install falling in either range as potentially affected.

Patch Status

No fixed version, vendor patch statement, or required remediation action is present in the supplied KEV or NVD data. The references point to the plugin's live trunk source in the WordPress plugin repository and to the Wordfence threat-intel entry, which are the authoritative places to check for a patched release.

Sources