CVE-2021-24845: Improved Include Page Project Improved Include Page

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.

Affected products

• Improved Include Page Project Improved Include Page: up to and including 1.2

Published 2021-12-13. Last modified 2026-06-17.