CVE-2021-24872

CVE-2021-24872: Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

Vendor Unknown

Product Get Custom Field Values

Weakness CWE-863 · Incorrect authorization

Published December 13, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

Key dates

02Disclosure timeline

December 13, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24872 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html