CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'get_posts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft posts and password protected posts, as well as the password for password-protected posts.
Explanation of Vulnerability in Simple Terms
Post Grid versions 2.2.68 and earlier contain an information disclosure vulnerability. An attacker can read sensitive data without authentication by exploiting improper access controls. The vulnerability requires only network access and no user interaction. Site administrators should update to a version newer than 2.2.68 immediately.
What an attacker can do
Read sensitive data from the site without logging in.
Potential impact on your site
Confidential information may be exposed to unauthenticated visitors.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
