CVE-2024-3936

MEDIUM

The Post Grid < 7.6.1 - Authenticated Unauthorized Data Modification via rtTPGSaveSettings Function

Title source: llm
STIX 2.1

Description

The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtTPGSaveSettings function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or higher, to change the plugin's settings and invoke other functions hooked by AJAX actions.

References (3)

Core 3

Scores

CVSS v3 4.3
EPSS 0.0056
EPSS Percentile 42.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-862
Status published
Products (1)
techlabpro1/The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid < 7.6.1
Published May 02, 2024
Tracked Since Feb 18, 2026