Schema Pro < 2.7.16 - Contributor+ Custom Field Access

2024-03-0400:00:00

Scott Kingsley Clark

schema pro

contributor

custom field access

post meta key

9.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode

As a contributor, add/edit a post and embed `[aiosrs_pro_custom_field post_id="ANY_POST_ID" field_key="ANY_META_KEY"]` and specify/guess any post ID and meta key you may want to access

Save the post and preview it to disclose the post meta key value