Post Grid Combo Vulnerability – 36+ Gutenberg Blocks – Information Exposure via get_posts API Endpoint – CVE-2023-7072 | WordPress Plugin Vulnerability Report

Plugin Name: Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks

Key Information:

  • Software Type: Plugin
  • Software Slug: post-grid
  • Software Status: Active
  • Software Author: pickplugins
  • Software Downloads: 2,751,180
  • Active Installs: 50,000
  • Last Updated: March 13, 2024
  • Patched Versions: 2.2.69
  • Affected Versions: <= 2.2.68

Vulnerability Details:

  • Name: Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68
  • Title: Information Exposure via get_posts API Endpoint
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • CVE: CVE-2023-7072
  • CVSS Score: 7.2
  • Publicly Published: March 12, 2024
  • Researcher: Hung -mov Nguyen
  • Description: The Post Grid Combo plugin for WordPress, integrating various functionalities including Post Grid, Form Maker, Popup Maker, and WooCommerce Blocks, has a critical vulnerability in its 'get_posts' REST API Endpoint. This flaw, present in versions up to and including 2.2.68, allows unauthenticated attackers to expose sensitive information, such as draft posts and password-protected posts along with their passwords.


The widely utilized Post Grid Combo plugin, known for offering a versatile range of Gutenberg blocks, has been compromised by an information exposure vulnerability, posing a significant risk to WordPress sites using versions up to 2.2.68. The vulnerability, cataloged as CVE-2023-7072, enables unauthenticated access to sensitive content, undermining website security and user privacy. Addressing this issue, the developers have released a patched version 2.2.69, which eliminates the vulnerability and reinforces the plugin's security.

Detailed Overview:

Discovered by cybersecurity researcher Hung -mov Nguyen, this vulnerability highlights the critical importance of securing API endpoints and ensuring that sensitive data is adequately protected from unauthorized access. The exposure of draft and password-protected posts could lead to significant privacy breaches and content theft, emphasizing the need for stringent security practices in plugin development.

Advice for Users:

  • Immediate Action: Users are strongly advised to update the Post Grid Combo plugin to version 2.2.69 immediately to safeguard their WordPress sites against potential data exposure.
  • Check for Signs of Vulnerability: Website administrators should review their site logs for unauthorized API access attempts and inspect the site for any unusual content leaks.
  • Alternate Plugins: While the current version is secure, users concerned about future vulnerabilities may consider evaluating alternative plugins that offer similar functionality with a strong security track record.
  • Stay Updated: Maintaining all WordPress components, including plugins and themes, at their latest versions is crucial for protecting against known vulnerabilities and optimizing site performance.


The swift resolution of CVE-2023-7072 in the Post Grid Combo plugin serves as a vital reminder of the ongoing challenges in maintaining cybersecurity in the digital landscape. For WordPress site owners, particularly small business operators with limited IT support, the proactive management of software updates and a keen awareness of security advisories are essential for preserving the security and integrity of their online presence. Embracing a culture of security and regular maintenance is indispensable in navigating the complex world of web security.



In today's digital age, maintaining the security of your WordPress site is crucial for protecting your online presence and the data of your users. The recent discovery of a significant vulnerability within the Post Grid Combo – 36+ Gutenberg Blocks plugin highlights the ongoing need for vigilance and regular updates to safeguard your website from potential threats.

Risks and Potential Impacts

The exposure of sensitive information could lead to privacy breaches, unauthorized content access, and potential data theft. The compromise of draft and password-protected content threatens the integrity and confidentiality of website data, putting user trust at risk.

Remediation Steps

  • Immediate Action: Update the Post Grid Combo plugin to version 2.2.69 immediately to mitigate this vulnerability.
  • Monitoring: Regularly monitor your website for signs of unauthorized access or unusual activities.
  • Alternative Solutions: Consider exploring alternative plugins that provide similar functionalities but with a robust security framework.

Previous Vulnerabilities

This is not the first time vulnerabilities have been discovered in the Post Grid Combo plugin, with 7 previous vulnerabilities reported since November 8, 2016. This history emphasizes the importance of ongoing security assessments and updates.

Conclusion: The Imperative of Cybersecurity Vigilance

The resolution of CVE-2023-7072 serves as a critical reminder of the continuous challenges posed by cybersecurity threats. For WordPress site administrators, especially small business owners who may lack extensive technical resources, staying informed about potential vulnerabilities and ensuring timely updates of all software components are essential practices for securing digital assets. Adopting a proactive security posture is indispensable for maintaining a secure and trusted online environment in today's interconnected world.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Post Grid Combo Vulnerability – 36+ Gutenberg Blocks – Information Exposure via get_posts API Endpoint – CVE-2023-7072 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment