Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

Proof of Concept

With the WooCommerce plugin installed, add the following shortcode in a post as a contributor: [field _billing_email id="{order_id}"]

This would print out the order billing email, which contributors should have no access to!

This is valid for any post where the user is not allowed to access, but can use the shortcode to extrafiltrate any data by key/id.