CVE-2021-24845CWE-284

Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access

published December 13, 2021

CVSS
—
EPSS
1%
Percentile
63.3
In the wild
Unconfirmed
What it is

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01028 · 63.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-12-13T10:41Z
EPSS history
Timeline
  • 13 DEC 10:41Z
    Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access
    cvelistv5