CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

  • Published Sep 5, 2026
  • CVSS 9.8 critical
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2024-11080 at the National Vulnerability Database