Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
Priority LOW 21CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
Why it matters now
EPSS 0.00794 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Custom Content Shortcode (Unknown): 4.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Custom Content Shortcode | 4.0.1 to before 4.0.1 | 4.0.1 | Patch available | CNA |
- Custom Content Shortcode VendorUnknown Affected 4.0.1 to before 4.0.1 Fixed in 4.0.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:custom_content_shortcode_project:custom_content_shortcode:*:*:*:*:*:wordpress:*:* | before 4.0.1 | Vulnerable | Custom Content Shortcode Project |
- cpe:2.3:a:custom_content_shortcode_project:custom_content_shortcode:*:*:*:*:*:wordpress:*:* Versions before 4.0.1 Vulnerable ·Custom Content Shortcode Project
Remediation
- Fix · CNA Custom Content Shortcode (Unknown) Fixed in 4.0.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24824
- 2026-10-03 Alias added: GHSA-28mp-cx45-6mwq
References
More Custom Content Shortcode Project Custom Content Shortcode vulnerabilities
- TI-2023-00324 Custom Content Shortcode <= 4.0.2 - Contributor+ LFI CVSS 3.1HIGH 8.8
- TI-2023-00258 Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2021-07108 Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.4
- TI-2021-07107 Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-24824 · CVE Program
- CVE-2021-24824 · NVD
- FIRST EPSS
- GHSA-28mp-cx45-6mwq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences