4.3
Medium
CVE-2024-1564 The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access…
Description
The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wp-schema-pro 2.7 | earliest → < 2.7.16 | 2.7.16 |
| wpschema_pro 2.7 | earliest → < 2.7.16 | 2.7.16 |