title: Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
description: The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
problem types: CWE-863 Incorrect Authorization
affected:
{
product: Get Custom Field Values
vendor: Unknown
versions:
lessThan: 4.0, status: affected, version: 4.0, versionType: custom
}