PT-2021-16326 · WordPress · Improved Include Page

Francesco Carlucci · Published 2021-12-13 · Updated 2022-07-29 · CVE-2021-24845

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Improved Include Page WordPress plugin versions 1.2 and earlier

Description: The issue allows users with a role as low as Contributor to gain access to content they are not supposed to by passing shortcode attributes with post type and post status. This can be used to retrieve arbitrary content.

Recommendations: For Improved Include Page WordPress plugin versions 1.2 and earlier, consider disabling the shortcode functionality until a patch is available to prevent users from accessing unauthorized content. Restrict access to the post type and post status attributes to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-24845

Affected Products

Improved Include Page

References · 4

• 🔥 https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24845 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24845 · Vendor Advisory
• https://t.me/cibsecurity/33812 · Telegram Post