CVE-2023-0890

Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts

Affected

WordPress Shortcodes Plugin — Shortcodes Ultimate

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.65% chance of exploitation in the next 30 days, 50th percentile

Published

2023-03-20

Updated

2025-02-26

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8a466f15-f112-4527-8b02-4544a8032671

References

• CVE Record
• NVD entry