The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an input validation flaw (CWE-20) that permits unauthenticated attackers to create orders and mark them as paid without actual payment. This occurs because the plugin does not sufficiently verify form field inputs, enabling unauthorized order creation. The issue affects all versions up to and including 2.3.5. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor advisory is currently available.

An attacker can create fraudulent orders and mark them as paid without completing payment, potentially leading to financial loss or inventory discrepancies. There is no impact on confidentiality or availability. The integrity of order data is partially compromised due to unauthorized order creation and payment status manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the affected plugin or restricting access to order creation functionality if possible. Monitor for updates from the vendor regarding an official fix.