CVE-2021-24872CWE-863

Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

published December 13, 2021

CVSS
—
EPSS
1%
Percentile
63.3
In the wild
Unconfirmed
What it is

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01028 · 63.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-12-13T10:41Z
EPSS history
Timeline
  • 13 DEC 10:41Z
    Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
    cvelistv5