CVE-2024-1995

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Mar 20, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-19965.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versionsCVE-2024-19975.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the MeCVE-2024-19995.4The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TesCVE-2024-20005.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi ScCVE-2024-200016.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2024-200026.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2024-200037.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200047.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200058.2In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SystemCVE-2024-200066.7In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System eCVE-2024-200077.5In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no aCVE-2024-200098.8In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privile
CVE-2024-1995: Medium severity, CVSS 4.3 | Vulnix