CVE-2024-13635

The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php
https://plugins.trac.wordpress.org/changeset/3233455/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3233455%40vk-blocks%2Ftrunk&old=3227170%40vk-blocks%2Ftrunk&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/cc03b3f4-2edb-463b-812b-6a187a7a893c?source=cve

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El complemento VK Blocks para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 1.94.2.2 incluida a través del bloqueo de contenido de la página. Esto permite que atacantes autenticados, con acceso de nivel de colaborador o superior, extraigan datos confidenciales, incluido el contenido de publicaciones y páginas privadas.

07 Mar 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-07 10:15

Updated : 2026-06-17 07:02

NVD link : CVE-2024-13635

Mitre link : CVE-2024-13635

CVE.ORG link : CVE-2024-13635

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-13635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-13635", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-07T14:10:33.264209Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "vektor-inc", "product": "VK Blocks", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.94.2.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-03-07T10:15:15.840", "references": [{"url": "https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3233455/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3233455%40vk-blocks%2Ftrunk&old=3227170%40vk-blocks%2Ftrunk&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc03b3f4-2edb-463b-812b-6a187a7a893c?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages."}, {"lang": "es", "value": "El complemento VK Blocks para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n confidencial en todas las versiones hasta la 1.94.2.2 incluida a trav\u00e9s del bloqueo de contenido de la p\u00e1gina. Esto permite que atacantes autenticados, con acceso de nivel de colaborador o superior, extraigan datos confidenciales, incluido el contenido de publicaciones y p\u00e1ginas privadas."}], "lastModified": "2026-06-17T07:02:25.413", "sourceIdentifier": "security@wordfence.com"}