The [field] shortcode included with the plugin, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
With the WooCommerce plugin installed, add the following shortcode in a post as a contributor: [field _billing_email id="{order_id}"]
This would print out the order billing email, which contributors should have no access to!
This is valid for any post where the user is not allowed to access, but can use the shortcode to extrafiltrate any data by key/id.