Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

2022-02-0200:00:00

Francesco Carlucci

woocommerce plugin

arbitrary post metadata access

unauthorised access

EPSS

0.001

Percentile

24.8%

JSON

The [field] shortcode included with the plugin, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved

With the WooCommerce plugin installed, add the following shortcode in a post as a contributor: [field _billing_email id="{order_id}"]

This would print out the order billing email, which contributors should have no access to!

This is valid for any post where the user is not allowed to access, but can use the shortcode to extrafiltrate any data by key/id.

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:7B4D4675-6089-4435-9B56-31496ADC4767