VULNERABILITY INTELLIGENCE

CVE-2024-13798

CVSS score5.3 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2025-02-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for products and mark them as paid without actually completing a payment.

Weakness classification

  • security@wordfence.com: CWE-20
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references