CVE-2023-0911

Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.

Affected

WordPress Shortcodes Plugin — Shortcodes Ultimate

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.65% chance of exploitation in the next 30 days, 50th percentile

Published

2023-03-20

Updated

2025-02-25

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444

References

• CVE Record
• NVD entry