CVE-2021-24872: Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-13 · updated 2026-06-17
Weakness: CWE-863

Description

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

Affected products

Get Custom Field Values: before 4.0 — fixed in 4.0

How to fix

Upgrade to a fixed version: Get Custom Field Values 4.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ec23734a-5ea7-4e46-aba9-3dee4e6dffb6
https://wpscan.com/vulnerability/ec23734a-5ea7-4e46-aba9-3dee4e6dffb6

Get alerted when CVE-2021-24872 or the next vulnerability affects your stack