CVE-2021-24819CWE-863

Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access

published December 13, 2021

CVSS
—
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-12-13T10:41Z
EPSS history
Timeline
  • 13 DEC 10:41Z
    Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access
    cvelistv5