Custom Content Shortcode <= 4.0.2 - Contributor+ LFI

CVE-2023-0340

Summary

The Custom Content Shortcode plugin for WordPress, up to version 4.0.2, contains a flaw in its validation of shortcode attributes, enabling users with contributor roles or higher to perform a traversal attack. This vulnerability can be exploited to include arbitrary files and read their content, including non-PHP files. Moreover, if an attacker uploads a malicious image embedded with PHP code, they could successfully execute remote code by including this file through the affected attribute. This poses a serious security risk, particularly in default WordPress installations where authors possess the capability to upload files.

References