Post Grid and Gutenberg Blocks Plugin 2.2.87/2.2.88/2.2.89/2.2.90 on WordPress privileges assignment

Summaryinfo

A vulnerability described as critical has been identified in Post Grid and Gutenberg Blocks Plugin 2.2.87/2.2.88/2.2.89/2.2.90 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation results in Remote Privilege Escalation. This vulnerability is reported as CVE-2024-8253. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Post Grid and Gutenberg Blocks Plugin 2.2.87/2.2.88/2.2.89/2.2.90 on WordPress. Affected is an unknown code block. The manipulation with an unknown input leads to a remote privilege escalation vulnerability. CWE is classifying the issue as CWE-266. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta to become an administrator.

The advisory is available at wordfence.com. This vulnerability is traded as CVE-2024-8253 since 08/28/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/12/2024). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• Post Grid and Gutenberg Blocks Plugin

Version

• 2.2.87
• 2.2.88
• 2.2.89
• 2.2.90

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion