Server-Side Request Forgery Vulnerability in Shortcodes Ultimate Plugin by WordPress
CVE-2025-12800
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 November 2025
What is CVE-2025-12800?
The Shortcodes Ultimate plugin for WordPress is vulnerable to a Server-Side Request Forgery (SSRF) attack that affects all versions up to and including 7.4.5. Authenticated users with Administrator-level access can exploit this vulnerability via the su_shortcode_csv_table function, allowing them to send requests to external resources from the web application. If the 'Unsafe features' option is activated by an administrator, even users with Contributor privileges can leverage this vulnerability to access and manipulate internal services, posing significant security risks.
Affected Version(s)
WP Shortcodes Plugin — Shortcodes Ultimate * <= 7.4.5