Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
Vulnerability Description
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
CVSS Information
N/A
Vulnerability Type
授权机制不正确
Vulnerability Title
WordPress 的 Custom Content Shortcode插件访问控制错误漏洞
Vulnerability Description
WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是WordPress开源的一个应用插件。 WordPress 的 Custom Content Shortcode插件 4.0.1之前版本存在访问控制错误漏洞，该漏洞允许身份验证的用户(角色低至contributor)访问任意发布的元数据，这可能会导致敏感数据的泄露。例如当与WooCommerce结合使用时，可以检索到订单的电子邮件地址。
CVSS Information
N/A
Vulnerability Type
N/A