CVE-2021-24845 in Improved Include Page Plugin
Summary
by MITRE • 12/13/2021
The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/15/2021
The CVE-2021-24845 vulnerability affects the Improved Include Page WordPress plugin version 1.2 and earlier, representing a critical access control flaw that undermines the security model of WordPress installations. This vulnerability stems from improper validation of shortcode attributes within the plugin's implementation, specifically when processing post_type and post_status parameters. The flaw allows authenticated users with minimal privileges to exploit the plugin's functionality and retrieve content they should not have access to, effectively bypassing WordPress's built-in content access controls. The vulnerability exists because the plugin fails to properly sanitize and validate user-supplied parameters before using them in database queries that fetch posts, creating an opportunity for privilege escalation through content enumeration.
The technical exploitation of this vulnerability occurs through the manipulation of shortcode attributes in the Improved Include Page plugin, where attackers can pass arbitrary values for post_type and post_status parameters. When these parameters are processed without proper validation, they can be used to construct database queries that retrieve posts from any post type or status, including drafts, private posts, or content belonging to other users. This flaw directly violates the principle of least privilege that governs WordPress user role management, where contributors should only access their own published content or content they have been explicitly granted permission to view. The vulnerability is particularly dangerous because it requires minimal user privileges to exploit, making it accessible to users with the lowest available roles such as contributors, subscribers, or even custom roles with limited permissions.
The operational impact of CVE-2021-24845 extends beyond simple information disclosure, as it can enable attackers to gather sensitive data about content creators, unpublished posts, draft content, and private information that should remain confidential. This vulnerability can be exploited to conduct reconnaissance activities, identify content that has not yet been published, or discover internal content structures that might reveal organizational information or planned content. The implications are particularly severe in environments where WordPress serves as a content management system for organizations with sensitive information, as it allows unauthorized access to draft content, private posts, or content that has been restricted for specific audiences. This type of vulnerability can also serve as a stepping stone for more advanced attacks, potentially enabling attackers to identify other system weaknesses or gather information that could be used in social engineering campaigns.
Organizations should immediately update to the patched version of the Improved Include Page plugin to address this vulnerability, as no effective workarounds exist without modifying the plugin code itself. The vulnerability aligns with CWE-20, which describes improper input validation, and represents a classic example of how insufficient parameter validation can lead to privilege escalation and unauthorized data access. From an ATT&CK perspective, this vulnerability maps to T1078 Valid Accounts and T1213 Data from Information Repositories, as it allows attackers to leverage legitimate user accounts to access restricted content repositories. System administrators should implement monitoring for unusual shortcode usage patterns and consider implementing additional access controls or content filtering measures. The vulnerability also highlights the importance of proper input sanitization and the need for comprehensive security testing of third-party plugins, particularly those that handle user-supplied parameters in database queries. Regular security audits of WordPress installations should include checks for similar vulnerabilities in other plugins, as this type of flaw is common in poorly validated shortcode implementations.