The User Meta Shortcodes WordPress plugin through 0.5...
Moderate severity
Unreviewed
Published
Dec 14, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Dec 13, 2021
Published to the GitHub Advisory Database
Dec 14, 2021
Last updated
Feb 1, 2023
The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
References