Lucene search
Francesco CarlucciWPVDB-ID:EC23734A-5EA7-4E46-ABA9-3DEE4E6DFFB6HistoryNov 09, 2021 - 12:00 a.m.
Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
2021-11-0900:00:00
Francesco Carlucci
wpscan.com
8
custom field access
plugin vulnerability
arbitrary post metadata
EPSS
0.001
Percentile
32.8%
The plugin allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
PoC
[custom_field field=“{field_name}” post_id=“{ID}”] e.g [custom_field field=“_ctct_verify_key” post_id=“23”]
Related
cnvd
cnvd
WordPress Get Custom Field Values plugin access control error vulnerability
2021-12-18 00:00:00
cvelist
cvelist
osv
osv
CVE-2021-24872
2021-12-13 11:15:09
cve
cve
CVE-2021-24872
2021-12-13 11:15:09
patchstack
patchstack
prion
prion
Design/Logic Flaw
2021-12-13 11:15:00
wpexploit
wpexploit
Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
2021-11-09 00:00:00
nvd
nvd
CVE-2021-24872
2021-12-13 11:15:09