Vulnerabilities > CVE-2021-24845 - Unspecified vulnerability in Improved Include Page Project Improved Include Page 1.2
Attack vector
NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |