CVE-2024-1995
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-1995
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1995.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-1995
- Published
- 2024-03-20T02:15:08Z
- Modified
- 2025-01-08T15:31:00.817143Z
- Summary
- [none]
- Details
-
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationalpostssearch() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.
- References
-
- https://github.com/inc2734/smart-custom-fields/commit/67cb6d75bd8189668f721dbd2dc7a3036851be1b
- https://plugins.trac.wordpress.org/browser/smart-custom-fields/trunk/classes/fields/class.field-related-posts.php#L78
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3052172%40smart-custom-fields&new=3052172%40smart-custom-fields&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e966a266-4265-4a72-8a50-e872805219a7?source=cve
Affected packages
Git / github.com/inc2734/smart-custom-fields
Affected ranges
- Type
- GIT
- Repo
- https://github.com/inc2734/smart-custom-fields
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.3.0
1.3.0b
1.3.1
1.3.2
1.4.0
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.7.0
2.*
2.0.0
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
3.*
3.0.0
3.0.1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.1.2
4.1.3
4.1.4
4.1.5
4.2.0
4.2.1
4.2.2