Executive Summary

The Meta Field Block plugin for WordPress has a vulnerability called Insecure Direct Object Reference (IDOR) in all versions up to and including 1.5.1.

This vulnerability occurs because the plugin allows users to specify arbitrary object IDs and object types through block attributes without checking if the authenticated user has permission to access the metadata of those objects.

As a result, attackers with Contributor-level access or higher can read arbitrary user meta, post meta, and term meta data from any object in the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored in meta fields.

On sites using plugins that store sensitive data in meta fields, such as WooCommerce billing and shipping information, attackers could access Personally Identifiable Information (PII) including names, email addresses, phone numbers, and physical addresses.

This exposure could compromise user privacy and potentially lead to further attacks or misuse of the leaked data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers with Contributor-level access and above to read arbitrary user meta, post meta, and term meta data from any object in the database. On sites using plugins that store sensitive data in meta fields, such as WooCommerce billing and shipping information, this could lead to the exposure of Personally Identifiable Information (PII) including names, email addresses, phone numbers, and physical addresses.

Exposure of such PII can result in non-compliance with data protection regulations and standards like GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access.

Useful 0 Not Useful 0