CVE-2024-11080 Overview
CVE-2024-11080 affects the Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress. The vulnerability enables unauthenticated hook injection through several functions in the ~/includes/blocks/form-wrap/function.php file. Attackers can invoke arbitrary WordPress hooks over the network without authentication or user interaction. The flaw is classified under CWE-94: Improper Control of Generation of Code. Impact depends on which hooks and downstream actions are reachable, but successful exploitation can trigger sensitive plugin or core actions if no secondary controls block the callback.
Critical Impact
Unauthenticated remote attackers can invoke arbitrary WordPress action or filter hooks, potentially executing privileged plugin logic on vulnerable sites.
Affected Products
- Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress
- Versions 2.2.32 through 2.3.1
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2026-09-05 - CVE-2024-11080 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2024-11080
Vulnerability Analysis
The ComboBlocks plugin exposes callable functionality that maps user-controlled input directly into WordPress hook invocations. The vulnerable code paths reside in includes/blocks/form-wrap/functions.php at multiple locations, including lines 116, 262, and 3249. Because the affected functions accept requests without verifying the caller, attackers reach them over standard HTTP without any credentials. Once inside, the code invokes hooks whose names or parameters are derived from the request, giving the attacker influence over which WordPress action or filter fires.
Root Cause
The root cause is improper control of code generation ([CWE-94]) combined with missing authentication and authorization checks on the affected form-handling endpoints. The plugin trusts request data to determine which hook to trigger and forwards that value to WordPress hook APIs. No capability check, nonce verification, or hook allowlist is enforced before the invocation.
Attack Vector
Exploitation requires only network access to the WordPress site. An unauthenticated attacker crafts a request to the vulnerable form-wrap endpoint and supplies a target hook name along with any parameters. WordPress then executes every callback registered to that hook. If the hook triggers privileged operations elsewhere in WordPress or in another installed plugin, the attacker inherits that behavior without ever authenticating. Refer to the Wordfence Vulnerability Report and the WordPress plugin source at line 116 for the affected code paths.
Detection Methods for CVE-2024-11080
Indicators of Compromise
- Unauthenticated POST requests targeting admin-ajax.php or REST routes registered by the ComboBlocks plugin with unexpected action or hook-name parameters.
- Unusual invocations of WordPress hooks originating from public form submissions on pages using ComboBlocks form-wrap blocks.
- New administrative users, modified options, or scheduled tasks created shortly after suspicious form-wrap traffic.
Detection Strategies
- Inventory WordPress installations and flag any running Post Grid and Gutenberg Blocks – ComboBlocks between versions 2.2.32 and 2.3.1.
- Review web server access logs for repeated requests to ComboBlocks form endpoints containing hook or action names in the request body.
- Correlate WordPress audit logs with web traffic to identify hook executions that lack a corresponding authenticated session.
Monitoring Recommendations
- Enable WordPress security plugin logging for AJAX and REST calls to record hook invocations and originating IPs.
- Alert on outbound connections or file changes that follow requests to the vulnerable plugin path.
- Monitor for creation or modification of privileged accounts, options such as siteurl and home, and PHP files in the uploads directory.
How to Mitigate CVE-2024-11080
Immediate Actions Required
- Update the Post Grid and Gutenberg Blocks – ComboBlocks plugin to a version later than 2.3.1 that addresses the hook injection issue.
- If patching is not immediately possible, deactivate and remove the plugin from every affected WordPress site.
- Audit administrator accounts, scheduled tasks, and modified files for signs of post-exploitation activity.
Patch Information
Upgrade to a fixed release of the ComboBlocks plugin as tracked in the Wordfence Vulnerability Report. Review the plugin source references to confirm the vulnerable functions have been hardened with authentication and hook allowlists in your deployed version.
Workarounds
- Place the WordPress site behind a web application firewall with rules that block requests supplying arbitrary hook names to ComboBlocks endpoints.
- Restrict access to admin-ajax.php and REST routes registered by ComboBlocks to authenticated users where feasible.
- Disable ComboBlocks form-wrap blocks on public-facing pages until the plugin is upgraded.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
