PT-2021-16311 · WordPress · Get Post Content Shortcode

Francesco Carlucci · Published 2021-12-13 · Updated 2021-12-16 · CVE-2021-24819

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Page/Post Content Shortcode WordPress plugin version 1.0

Description: The issue allows users with a role as low as contributor to access draft, private, password protected, and trashed posts and pages they should not be allowed to, including those created by other users such as admins and editors.

Recommendations: For Page/Post Content Shortcode WordPress plugin version 1.0, consider updating the plugin to a version that properly implements authorization to restrict access to sensitive content. As a temporary workaround, consider restricting the role of contributors to prevent them from accessing unauthorized posts and pages until a patch is available.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-24819

Affected Products

Get Post Content Shortcode

References · 4

• 🔥 https://wpscan.com/vulnerability/c97b218c-b430-4301-884f-f64d0dd08f07 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24819 · Security Note
• https://t.me/cibsecurity/33798 · Telegram Post