A missing authorization flaw in the PickPlugins Post Grid and Gutenberg Blocks plugin allows an attacker to exploit incorrectly configured access control security levels. The missing checks enable a user to perform privileged actions they are not supposed to have, such as viewing, modifying, or publishing content and altering plugin settings. This weakness aligns with the Broken Access Control CWE classification.

The WordPress plugin Post Grid and Gutenberg Blocks from PickPlugins is affected from unspecified earlier releases through version 2.3.17. Any installation of the plugin with a version number less than or equal to 2.3.17 is vulnerable.

The CVSS base score of 6.5 signals a medium severity issue, while an EPSS score of less than 1% indicates a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The most likely attack vector involves a web request to the plugin’s administrative endpoints, and the attacker may need to be authenticated with a role that grants access to the plugin’s functionality; however, the vulnerability permits escalation of privileges once authorized access is obtained.