CVE-2024-0881

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before version 2.2.76 contains an authorization flaw that exposes password-protected posts through unauthenticated AJAX endpoints. The affected component fails to enforce access controls on certain queries, allowing restricted post content to appear in responses that should be limited to authenticated users with the correct password.

Unauthenticated attackers can invoke the vulnerable AJAX actions to retrieve the full content of password-protected posts. This grants them read access to material that should remain hidden, with the CVSS 5.4 rating reflecting network-exploitable confidentiality and integrity impact without requiring user interaction.

Public references from WPScan document the missing authorization checks and identify the fixed release as 2.2.76. The EPSS score has remained flat at 0.1307 with no observed rise after disclosure.