CVE-2021-24859CWE-284

User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access

published December 13, 2021

CVSS
—
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-12-13T10:41Z
EPSS history
Timeline
  • 13 DEC 10:41Z
    User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
    cvelistv5