CVE-2021-24851CWE-863

Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access

published November 17, 2021

CVSS
—
EPSS
1%
Percentile
60.6
In the wild
Unconfirmed
What it is

The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00943 · 60.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-11-17T10:15Z
EPSS history
Timeline
  • 17 NOV 10:15Z
    Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access
    cvelistv5