A critical unauthenticated hook injection vulnerability in the Post Grid and Gutenberg Blocks plugin exposes WordPress sites to remote code execution and full system compromise.

This is an improper control of generation of code vulnerability (CWE-94) occurring within the ~/includes/blocks/form-wrap/function.php file. The flaw permits unauthenticated attackers to trigger arbitrary WordPress hooks, effectively bypassing security controls to execute unauthorized actions.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the web server, potentially leading to total data exfiltration, unauthorized administrative access, and persistent backdoors within the WordPress environment.

Immediate Action: Review vendor release notes for a version greater than 2.3.32 and apply the update immediately. If a patch is not yet available, deactivate the plugin until the vendor provides a secure version.

Proactive Monitoring: Monitor server access logs for anomalous POST requests targeting the ~/includes/blocks/form-wrap/ directory or unusual execution patterns originating from non-authenticated users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific PHP functions and unexpected hook invocations.

Public Exploit Available: Unknown

Given the critical severity of this flaw and the lack of authentication required to execute malicious hooks, immediate action is mandatory. Administrators should verify their current plugin version and prioritize the removal or patching of the affected code to prevent potential full site takeover.