CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through 1.2.0.
Explanation of Vulnerability in Simple Terms
A WordPress plugin for displaying custom fields lacks proper authorization checks. An authenticated user with low privileges can read custom field data they should not have access to. The vulnerability affects versions up to 1.2.0. Update to a version newer than 1.2.0 to resolve this issue.
What an attacker can do
Read custom field data belonging to other users or posts without authorization.
Potential impact on your site
Private user profile fields and post custom fields may be exposed to low-privilege site members.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
