Vulnerability · Published Dec 13, 2021 · Assigned by WPScan
CVE-2021-24859User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
Medium 4.3
In plain English
A medium-severity improper access control in User meta shortcodes from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)0.8%top 42.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User meta shortcodes | 0.5 – through 0.5 |
Weakness: CWE-284