CVE-2021-24859
Assigner: WPScan
Published: 2021-12-13T10:41:11
State: PUBLISHED
affected: product: User meta shortcodes
vendor: Unknown
versions: lessThanOrEqual: 0.5
status: affected
version: 0.5
versionType: custom
credits: value: Francesco Carlucci
descriptions: value: The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
source: discovery: EXTERNAL
title: User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
x_generator: WPScan CVE Generator