Improved Include Page <= 1.2 - Authenticated (Contributor+) Arbitrary Posts/Pages Access
mediumThe Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.
- CVSS:
- 4.3
- Affected:
- up to 1.2
- Fix:
- No patched version reported
- Disclosed:
- Nov 15, 2021