CVE-2021-24859 — User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying t…
Published: 2021-12-13 · CVSS: Unscored
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7