Critical Unauthenticated Hook Injection in ComboBlocks WordPress Plugin

Executive Summary

A critical unauthenticated hook injection vulnerability (CVE-2024-11080) has been disclosed in Post Grid and Gutenberg Blocks – ComboBlocks, a WordPress plugin from pickplugins. Versions 2.2.32 through 2.3.1 fail to validate or sanitize input before passing it into dynamic WordPress action hooks, allowing unauthenticated attackers to trigger arbitrary hook execution — and, depending on server configuration and what other code is present, potentially achieve full remote code execution.

CVSS Score: 9.8 (Critical), CWE-94 (Improper Control of Generation of Code / "Code Injection"), assigned by Wordfence.

A fix is available in version 2.3.2.

Vulnerability Overview

Affected Versions

Technical Details

Several functions in function.php build dynamic action hooks using attacker-influenced input without properly validating or sanitizing it first. WordPress's hook system executes arbitrary registered callbacks by name at runtime — if an attacker can control the name (or arguments) of a hook that gets fired, they can trigger actions that were never meant to be reachable by an anonymous visitor.

Because no authentication is required to reach the vulnerable form-handling code, an unauthenticated attacker can:

• Execute WordPress actions/hooks that should require authentication or specific capabilities
• Depending on which plugins/hooks are registered on the target site, potentially escalate to arbitrary PHP code execution

1. Attacker identifies a WordPress site running ComboBlocks 2.2.32-2.3.1
2. Attacker submits a crafted request to the vulnerable form-wrap endpoint
3. Unsanitized input is used to construct/trigger a dynamic action hook
4. Any code registered against that hook executes with the site's normal privileges
5. Depending on installed plugins, this can lead to data manipulation, privilege
   escalation, or full remote code execution

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 2.3.2

# Via WP-CLI
wp plugin update post-grid
 
# Verify the installed version
wp plugin get post-grid --field=version

Or update through WordPress admin: Plugins > Installed Plugins > ComboBlocks > Update Now.

Step 2: Audit for Prior Compromise

# Look for unexpected admin users created around the incident window
wp user list --role=administrator --fields=ID,user_login,user_registered
 
# Check for unfamiliar PHP files in uploads
find /path/to/wordpress/wp-content/uploads/ -name "*.php" -type f

If Immediate Patching Isn't Possible

1. Deactivate the ComboBlocks plugin until it can be updated.
2. Block requests to the vulnerable form-wrap endpoint at the WAF level.
3. Monitor access logs for anomalous POST requests targeting plugin form endpoints.

Post-Remediation Steps

1. Confirm plugin updated to 2.3.2 or later.
2. Review administrator accounts for anything unfamiliar.
3. Scan the installation for webshells or unauthorized file modifications.
4. Rotate credentials — WordPress admin, database, API keys.
5. Deploy a WAF (Wordfence, Sucuri) for defense in depth going forward.

References

• Wordfence Threat Intelligence — ComboBlocks Hook Injection
• NIST NVD — CVE-2024-11080
• OffSeq Threat Radar — CVE-2024-11080

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active