The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444 - Exploit, Third Party Advisory |
28 Mar 2023, 13:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | (MISC) https://wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444 - Exploit, Third Party Advisory | |
| CWE | CWE-862 |
20 Mar 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-20 16:15
Updated : 2025-02-25 21:15
NVD link : CVE-2023-0911
Mitre link : CVE-2023-0911
CVE.ORG link : CVE-2023-0911
JSON object : View
Products Affected
getshortcodes
- shortcodes_ultimate
CWE
CWE-862
Missing Authorization