CVE-2024-1564

The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode
Configurations

Configuration 1 (hide)

cpe:2.3:a:brainstormforce:schema:*:*:*:*:pro:wordpress:*:*

History

27 Jun 2025, 15:31

Type Values Removed Values Added
First Time Brainstormforce
Brainstormforce schema
CWE NVD-CWE-noinfo
References () https://wpscan.com/vulnerability/ecb1e36f-9c6e-4754-8878-03c97194644d/ - () https://wpscan.com/vulnerability/ecb1e36f-9c6e-4754-8878-03c97194644d/ - Exploit, Third Party Advisory
CPE cpe:2.3:a:brainstormforce:schema:*:*:*:*:pro:wordpress:*:*

21 Nov 2024, 08:50

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/ecb1e36f-9c6e-4754-8878-03c97194644d/ - () https://wpscan.com/vulnerability/ecb1e36f-9c6e-4754-8878-03c97194644d/ -

09 Aug 2024, 21:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.3

25 Mar 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) El complemento wp-schema-pro de WordPress anterior a 2.7.16 no valida el acceso a la publicación, lo que permite a un usuario colaborador acceder a campos personalizados en cualquier publicación, independientemente del tipo o estado de la publicación a través de un código corto.

25 Mar 2024, 05:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-03-25 05:15

Updated : 2025-06-27 15:31


NVD link : CVE-2024-1564

Mitre link : CVE-2024-1564

CVE.ORG link : CVE-2024-1564


JSON object : View

Products Affected

brainstormforce

  • schema