WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)
CVE-2023-23800

7.1HIGH

Key Information:

Vendor
WordPress
Status
WP Shortcodes Plugin — Shortcodes Ultimate
Vendor
CVE Published:
13 November 2023

Summary

The WP Shortcodes Plugin by Vova Anokhin contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to send requests from the server to internal or external systems by manipulating the input parameters of the plugin. This can lead to unauthorized access and exposure of sensitive data. The vulnerability impacts the Shortcodes Ultimate plugin in versions prior to 5.12.6, making it crucial for users to update their installations to mitigate potential security risks.

Affected Version(s)

WP Shortcodes Plugin — Shortcodes Ultimate <= 5.12.6

References

https://patchstack.com/database/vulnerability/shortcodes-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.