CVE-2024-1995
Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
概要
Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web plugins.trac.wordpress.org
- web plugins.trac.wordpress.org
- web wordfence.com