CVE-2021-24872

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

• CWE-863

• https://wpscan.com/vulnerability/ec23734a-5ea7-4e46-aba9-3dee4e6dffb6Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/ec23734a-5ea7-4e46-aba9-3dee4e6dffb6Exploit, Third Party Advisory

Published

Dec 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24866The WP Data Access WordPress plugin before 5.0.0 does not pr…9.8
• CVE-2021-24867Numerous Plugins and Themes from the AccessPress Themes (aka…9.8
• CVE-2021-24868The Document Embedder WordPress plugin before 1.7.9 contains…4.3
• CVE-2021-24869The WP Fastest Cache WordPress plugin before 0.9.5 does not …8.8
• CVE-2021-24870The WP Fastest Cache WordPress plugin before 0.9.5 is lackin…6.1
• CVE-2021-24871The Get Custom Field Values WordPress plugin before 4.0.1 do…5.4
• CVE-2021-24873The Tutor LMS WordPress plugin before 1.9.11 does not saniti…6.1
• CVE-2021-24874The Newsletter, SMTP, Email marketing and Subscribe forms by…6.1
• CVE-2021-24875The eCommerce Product Catalog Plugin for WordPress plugin be…6.1
• CVE-2021-24876The Registrations for the Events Calendar WordPress plugin b…6.1
• CVE-2021-24877The MainWP Child WordPress plugin before 4.1.8 does not vali…7.2
• CVE-2021-24878The SupportCandy WordPress plugin before 2.2.7 does not sani…6.1