The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f - Exploit, Third Party Advisory |
29 Jul 2022, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
16 Dec 2021, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
| CPE | cpe:2.3:a:improved_include_page_project:improved_include_page:*:*:*:*:*:wordpress:*:* |
13 Dec 2021, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-12-13 11:15
Updated : 2024-11-21 05:53
NVD link : CVE-2021-24845
Mitre link : CVE-2021-24845
CVE.ORG link : CVE-2021-24845
JSON object : View
Products Affected
improved_include_page_project
- improved_include_page
CWE