CVE-2024-1452

MEDIUM 4.3CVE-2024-1452 · Published 13/03/2024 · updated 17/06/2026

In short

CVE-2024-1452 is a MEDIUM (CVSS 4.3) vulnerability affecting generateblocks (generatepress).
Chance of exploitation in the next 30 days (EPSS): 0.57%, higher than 47.6% of all vulnerabilities.
Fix: update to 1.8.3 or later.

Package	Affected versions	Patched versions
generateblocks generatepress	`< 1.8.3`	`1.8.3`

Description

The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Query Loop. This makes it possible for authenticated attackers, with contributor access and above, to see contents of posts and pages in draft or private status as well as those with scheduled publication dates.

References

plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-query-loop.php · Product
plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-query-loop.php · Product
plugins.trac.wordpress.org/changeset · Patch
wordfence.com/threat-intel/vulnerabilities/id/62f19301-2311-4989-a5f2-9f845b72dd54 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free