CVE-2024-43235 – WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerability

https://notcve.org/view.php?id=CVE-2024-43235

Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10. The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the query function called via 'ajax_get_posts' in versions up to, and including, 5.9.10. This makes it possible for authenticated attackers, with contributor-level access and above, to view arbitrary posts. • https://patchstack.com/database/vulnerability/meta-box/wordpress-meta-box-plugin-5-9-10-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •