CVE-2024-1204: Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure
Published Apr 15, 2024
·Updated
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
Affected Software
2 affected components
Metabox Meta Box Wordpress<5.9.4
Meta Box Meta Box<5.9.4
Event History
Apr 15, 2024
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
DescriptionWeakness
Data Sourced
via NVD·05:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-1204?
CVE-2024-1204 has a medium severity level due to unauthorized access to custom fields in WordPress.
2
How do I fix CVE-2024-1204?
To fix CVE-2024-1204, update the Meta Box WordPress plugin to version 5.9.4 or later.
3
Who is affected by CVE-2024-1204?
Users with the contributor role in WordPress who have the Meta Box plugin installed before version 5.9.4 are affected by CVE-2024-1204.
4
What kind of access does CVE-2024-1204 allow?
CVE-2024-1204 allows users with at least the contributor role to access arbitrary custom fields assigned to other users' posts.
5
Is there a workaround for CVE-2024-1204?
Disabling the Meta Box plugin is a temporary workaround for CVE-2024-1204 until the plugin is updated.