CVE-2023-6983

MEDIUM

Josevega Display Custom Fields IN The... - IDOR

Title source: rule

Description

The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve potentially sensitive post meta.

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3021133%40shortcode-to-display-post-and-user-data&new=3021133%40shortcode-to-display-post-and-user-data&sfp_email=&sfph_mail=

Patch, Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/08d43c67-df40-4f1a-a351-803e59edee13?source=cve

Scores

CVSS v3 4.3

EPSS 0.0025

EPSS Percentile 47.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (2)

josevega/Display custom fields in the frontend – Post and User Profile Fields < 1.2.1

josevega/display_custom_fields_in_the_frontend_-_post_and_user_profile_fields < 1.3.0

Published Feb 05, 2024

Tracked Since Feb 18, 2026