Описание
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.0.1 (исключая)
cpe:2.3:a:custom_content_shortcode_project:custom_content_shortcode:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 40%
0.00181
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-863
CWE-863
Связанные уязвимости
CVSS3: 4.3
github
больше 3 лет назад
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
EPSS
Процентиль: 40%
0.00181
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-863
CWE-863