ND Shortcodes < 7.0 - Subscriber+ LFI

CVE-2023-1273

Summary

The ND Shortcodes plugin for WordPress, specifically in versions prior to 7.0, contains a vulnerability where it fails to validate certain shortcode attributes. This oversight allows any authenticated user, including those with minimal permissions such as subscribers, to exploit the functionality within the plugin to perform Local File Inclusion attacks. By manipulating input values to generate file paths, attackers can gain access to sensitive files on the server, potentially compromising the security of the entire WordPress installation.

References