Skip to content
Sign in
Not rated

CVE-2021-24851 The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and…

Description

The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue.

Affected products and versions

Product Affected versions Fixed in
Insert Pages 3.7 earliest → < 3.7.0 3.7.0

Other CVEs of Insert Pages

The 3 CVEs of Insert Pages →
CVE-2022-4483 The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before… 5.4 Medium CVE-2021-24850 The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields Not rated
Track this CVE