CVE-2024-10910: Grid Plus WordPress Plugin RCE Vulnerability

CVE-2024-10910 Overview

CVE-2024-10910 affects the Grid Plus – Unlimited grid layout plugin for WordPress in all versions up to and including 1.3.5. The plugin exposes the grid_plus_load_by_category AJAX action without properly validating user-supplied input before passing it to do_shortcode. Unauthenticated attackers can invoke this AJAX endpoint over the network to execute arbitrary WordPress shortcodes on the target site. The flaw is classified as Improper Control of Generation of Code [CWE-94] and impacts confidentiality, integrity, and availability of affected installations.

Critical Impact

Unauthenticated remote attackers can execute arbitrary shortcodes on vulnerable WordPress sites, enabling abuse of any shortcode registered by WordPress core, themes, or other installed plugins.

Affected Products

• Grid Plus – Unlimited grid layout plugin for WordPress, all versions through 1.3.5
• WordPress installations exposing the grid_plus_load_by_category AJAX action
• Sites with additional plugins or themes that register privileged shortcodes

Discovery Timeline

• 2024-12-12 - CVE-2024-10910 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-10910

Vulnerability Analysis

The Grid Plus plugin registers the grid_plus_load_by_category AJAX handler in core/ajax_fe.php to dynamically load grid items by category. The handler accepts a category or content parameter from the client and passes it into WordPress's do_shortcode function without restricting the value to an expected allowlist. Because the AJAX action is registered for unauthenticated users through the wp_ajax_nopriv_ hook pattern, any visitor can reach the endpoint without credentials. The vulnerability is a code injection issue [CWE-94] in which attacker-controlled input is interpreted by the shortcode engine.

Root Cause

The root cause is missing input validation before invocation of do_shortcode. The plugin treats the incoming AJAX parameter as trusted shortcode content rather than as untrusted data that must be sanitized or matched against an allowlist of expected category identifiers. Combined with the unauthenticated AJAX registration, this allows any client to supply arbitrary shortcode markup for server-side evaluation.

Attack Vector

Exploitation requires only network access to the WordPress site's admin-ajax.php endpoint. An attacker submits a POST request with action=grid_plus_load_by_category and a crafted payload containing arbitrary shortcode strings. WordPress dispatches the request to the vulnerable handler, which calls do_shortcode on the attacker-controlled value. The resulting impact depends on which shortcodes are registered on the target site. Shortcodes from other plugins that disclose data, render administrative content, or perform privileged actions can be abused to escalate the impact beyond the Grid Plus plugin itself. Technical details are documented in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-10910

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing the parameter action=grid_plus_load_by_category from unauthenticated sources
• Request bodies containing shortcode syntax such as [ and ] brackets in parameters passed to the Grid Plus AJAX action
• Unexpected rendering of shortcodes from unrelated plugins in AJAX responses originating from grid_plus_load_by_category
• Spikes in AJAX traffic to the Grid Plus endpoint from a small number of source IP addresses

Detection Strategies

• Inspect web server and WordPress access logs for the grid_plus_load_by_category action invoked without a valid session cookie
• Deploy a Web Application Firewall (WAF) rule that flags shortcode-style bracket sequences inside POST parameters to admin-ajax.php
• Compare expected category identifier values against the AJAX parameter content and alert on deviations

Monitoring Recommendations

• Forward WordPress access logs to a centralized analytics platform and build alerts for the vulnerable AJAX action
• Monitor outbound HTTP requests from the WordPress host that correlate with shortcodes capable of issuing remote calls
• Track plugin inventory and version data to identify hosts still running Grid Plus 1.3.5 or earlier

How to Mitigate CVE-2024-10910

Immediate Actions Required

• Identify all WordPress sites with the Grid Plus plugin installed and confirm the installed version
• Disable or remove the Grid Plus plugin on any site running version 1.3.5 or earlier until a fixed release is applied
• Restrict access to admin-ajax.php requests targeting grid_plus_load_by_category at the WAF or reverse proxy layer
• Audit installed plugins and themes for shortcodes that expose sensitive data or privileged operations

Patch Information

At the time of NVD publication, the vulnerability affects all versions up to and including 1.3.5. Administrators should consult the WordPress plugin developer page for the latest available release and apply any version that addresses the grid_plus_load_by_category shortcode handling issue.

Workarounds

• Deactivate the Grid Plus plugin until a fixed version is installed
• Add a WAF rule blocking POST requests to admin-ajax.php where action=grid_plus_load_by_category and the payload contains shortcode brackets
• Remove or unregister high-impact shortcodes from other plugins that are not required on the site to reduce blast radius
• Limit access to admin-ajax.php from untrusted networks where business requirements allow

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($request_body ~* "action=grid_plus_load_by_category") {
            return 403;
        }
    }
}