CVE-2021-24824: Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-07 · updated 2026-06-17
Weakness: CWE-863

Description

The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved

Affected products

Custom Content Shortcode: before 4.0.1 — fixed in 4.0.1

How to fix

Upgrade to a fixed version: Custom Content Shortcode 4.0.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7b4d4675-6089-4435-9b56-31496adc4767
https://wpscan.com/vulnerability/7b4d4675-6089-4435-9b56-31496adc4767

Get alerted when CVE-2021-24824 or the next vulnerability affects your stack