Описание
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.5 (включая)
cpe:2.3:a:user_meta_shortcodes_project:user_meta_shortcodes:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 40%
0.00186
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-284
Связанные уязвимости
github
около 4 лет назад
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
EPSS
Процентиль: 40%
0.00186
Низкий
4.3 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-284