CVE-2024-1204

Published: Apr 15, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.

Affected (1)

Products: Metabox: Meta Box

Metabox

1 product

Meta Box

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Metabox Meta Box	Before 5.9.4

References (2)

https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.