The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an improper input validation vulnerability (CWE-20) in all versions up to 2.3.5. This flaw allows unauthenticated attackers to bypass payment verification by submitting manipulated form data, resulting in unauthorized creation of orders marked as paid. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild, and no official patch or remediation guidance is currently available.

An attacker can create fraudulent orders without completing payment, potentially causing financial loss or disruption to the affected e-commerce workflow. The integrity of order processing is compromised, but confidentiality and availability are not directly impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional server-side validation or restricting access to order creation endpoints to trusted users only. Monitor for updates from the plugin vendor regarding an official fix.