CVE-2024-13796

Medium

Published: 28 February 2025

Published

28 February 2025

Modified

06 March 2025

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0021 42.6th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13796 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Pickplugins Post Grid. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 42.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access, directly preventing unauthenticated attackers from accessing sensitive user data via the vulnerable /wp-json/post-grid/v2/get_users REST API endpoint.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws like the sensitive information exposure in Post Grid plugin versions up to 2.3.6, mitigating the CVE through patching.

AC-22 Publicly Accessible Content good match

preventdetect

Establishes controls and monitoring for publicly accessible content on WordPress sites, restricting and detecting unauthorized exposure of sensitive user data through vulnerable plugin APIs.

NVD Description

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensitive…

data including including emails and other user data.

Deeper analysisAI

CVE-2024-13796 is a sensitive information exposure vulnerability (CWE-200) affecting the Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress in all versions up to and including 2.3.6. The issue resides in the /wp-json/post-grid/v2/get_users REST API endpoint, which improperly exposes user data. It has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact and no impact on integrity or availability.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no privileges required. By sending requests to the affected REST API endpoint, they can extract sensitive user information, including email addresses and other user data, potentially enabling further phishing, spam, or targeted attacks on WordPress site users.

Advisories from Wordfence and the WordPress plugin repository provide details on mitigation. The Wordfence threat intelligence page documents the vulnerability, while WordPress Trac references show the vulnerable code in functions-rest.php at revision 3242718 (line 2055) and a patch applied in changeset 3245187 for the post-grid plugin repository. Security practitioners should update to a version beyond 2.3.6 and review access to REST API endpoints.