CVE-2021-24824CWE-863

Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

published March 7, 2022

CVSS
—
EPSS
1%
Percentile
55.9
In the wild
Unconfirmed
What it is

The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00794 · 55.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-03-07T08:16Z
EPSS history
Timeline
  • 07 MAR 08:16Z
    Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
    cvelistv5