CVE-2024-1995
Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
Summary
Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
Original description
The description as published by the source.
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web plugins.trac.wordpress.org
- web plugins.trac.wordpress.org
- web wordfence.com