CVE-2023-40211 WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure

Q: What is CVE-2023-40211?

CVE-2023-40211 is a high-severity vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-40211 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40211 exists.

Q: How do I fix CVE-2023-40211?

No fix has been published for CVE-2023-40211 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 30 Nov 2023 Updated 28 Apr 2026

An attacker can access sensitive information from the Post Grid Combo WordPress plugin without authorization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-40211?

CVE-2023-40211 is a high-severity vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.

Weakness: CWE-200

Which versions are affected by CVE-2023-40211?

It affects 1 product.

Products include Pickplugins Post Grid Combo.

How do I fix CVE-2023-40211?

No fix has been published for CVE-2023-40211 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-40211 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40211 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-j6r2-rpgf-7h3f.