The User Meta – User Profile Builder and User management plugin for WordPress contains an insecure direct object reference vulnerability (CWE-639) in the getUser() function due to lack of validation on a user-controlled key. This allows authenticated attackers with Contributor-level privileges or higher to retrieve user meta information from form fields, potentially exposing sensitive data like password hashes if a site administrator configures a vulnerable form. Unauthenticated exploitation is also possible if the 'user-meta-public-profile' shortcode is improperly used. The vulnerability affects all versions up to and including 3.1.1 and has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation details are currently provided by the vendor.

An attacker with Contributor-level access or above can bypass authorization controls to access user meta data, potentially including sensitive information such as password hashes, if the site administrator has created forms that expose such data. Unauthenticated users may also exploit the vulnerability if the 'user-meta-public-profile' shortcode is used insecurely. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid creating forms that expose sensitive user meta data and ensure the 'user-meta-public-profile' shortcode is not used insecurely. Restrict Contributor-level user capabilities where possible to limit exposure.