CVE-2021-24859: User Meta Shortcodes Project User Meta Shortcodes

Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days.

The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes

Affected products

• User Meta Shortcodes Project User Meta Shortcodes: up to and including 0.5

Published 2021-12-13. Last modified 2026-06-17.