CVE-2021-24872: Get Custom Field Values Project Get Custom Field Values

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

Affected products

• Get Custom Field Values Project Get Custom Field Values: before 4.0 (fixed in 4.0)

Published 2021-12-13. Last modified 2026-06-17.