Vulnerability Details CVE-2021-24859
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 40.8%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
Products affected by CVE-2021-24859
-
cpe:2.3:a:user_meta_shortcodes_project:user_meta_shortcodes:-
-
cpe:2.3:a:user_meta_shortcodes_project:user_meta_shortcodes:0.5