CVE-2024-1204 – Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure

https://notcve.org/view.php?id=CVE-2024-1204

The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts. El complemento Meta Box de WordPress anterior a 5.9.4 no impide que los usuarios con al menos el rol de colaborador accedan a campos personalizados arbitrarios asignados a las publicaciones de otros usuarios. The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 5.9.3. This is due to the plugin not properly restricting the post meta that can be displayed through the 'rwmb_meta' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta information. • https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •