The ComboBlocks WordPress plugin contains a flaw that allows unauthenticated users to inject arbitrary hooks into WordPress through several functions in the form‑wrap module. This hook injection can lead to execution of any code that the plugin’s hook mechanism permits, giving an attacker the full power of a system administrator on the compromised site. The underlying weakness is an improper input validation that permits arbitrary callback registration, class‑name injection, or function execution. The CVE lists CWE‑94 as the relevant weakness, which is consistent with the potential for code injection and remote code execution.

All installations of the ComboBlocks plugin for Post Grid between versions 2.2.32 and 2.3.1 are affected. The product is maintained by pickplugins and is integrated into WordPress sites that use the Post Grid and Gutenberg Blocks – ComboBlocks feature set. No specific operating system or server configuration is required to deploy the vulnerability; it is limited to the WordPress environment where the plugin resides.

The CVSS score for this vulnerability is 9.8, indicating exploitable code with high damage potential. EPSS is not available, leaving the exploitation probability unclear, but the absence of any mitigations in the default plugin code makes it likely that attackers could activate the vulnerability once it is discovered. It is not listed in the CISA KEV catalog, but the lack of mitigation and the severity suggest the vulnerability should be treated with high priority. The attack vector is inferred to be remote, unauthenticated, leveraging standard HTTP requests to WordPress endpoints that expose the vulnerable functions. Once an attacker injects a hook, they can execute any code that runs under the WordPress site's user context.