User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
CVE-2021-24859

4.3MEDIUM

Key Information:

Vendor

Wordpress
Status
User Meta Shortcodes
Vendor
CVE Published:
13 December 2021

What is CVE-2021-24859?

The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes

Affected Version(s)

User meta shortcodes 0.5

References

https://wpscan.com/vulnerability/958f44a5-07e7-4349-9212-...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.