title: User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access
description: The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes
problem types: CWE-284 Improper Access Control
affected:
{
product: User meta shortcodes
vendor: Unknown
versions:
lessThanOrEqual: 0.5, status: affected, version: 0.5, versionType: custom
}