CVE-2021-24819 Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access

2021-12-1310:41:02

CWE-863

WPScan

www.cve.org

wordpress

plugin

cve-2021-24819

authorisation issue

posts/pages access

contributor

arbitrary access

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.

CNA Affected

[
  {
    "product": "Page/Post Content Shortcode",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.0",
        "status": "affected",
        "version": "1.0",
        "versionType": "custom"
      }
    ]
  }
]