CVE-2024-10124

Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce, a WordPress plugin, is vulnerable to a missing capability check (CWE-284) on its tp_install() function, which can be reached without authentication. An unauthenticated attacker can invoke that function to install and activate arbitrary plugins on the target site. Because arbitrary plugins can be activated, the attacker can chain the flaw with any other installed plugin that has a known remote code execution bug to run code on the server, which is why the flaw carries a critical 9.8 CVSS score. All versions up to and including 1.1.1 are affected, and 1.1.1 contains only a partial fix, so sites on 1.1.1 or earlier remain exposed. No public proof-of-concept or confirmed in-the-wild exploitation is documented, but the flaw carries an elevated 31.2% EPSS (98th percentile), indicating a high likelihood of exploitation within 30 days.

What to do: Update Vayu Blocks to the latest available release beyond 1.1.1, since 1.1.1 is only a partial fix and earlier versions are fully unpatched. Until updated, review the site for unexpectedly installed or activated plugins and ensure no other installed plugin carries a known RCE vulnerability that could be chained into full remote code execution. As no workaround is described in the data, consider temporarily deactivating the plugin on high-value WooCommerce sites if prompt patching is not possible.