Server-Side Request Forgery Vulnerability in Shortcodes Ultimate Plugin by WordPress

CVE-2025-12800

What is CVE-2025-12800?

The Shortcodes Ultimate plugin for WordPress is vulnerable to a Server-Side Request Forgery (SSRF) attack that affects all versions up to and including 7.4.5. Authenticated users with Administrator-level access can exploit this vulnerability via the su_shortcode_csv_table function, allowing them to send requests to external resources from the web application. If the 'Unsafe features' option is activated by an administrator, even users with Contributor privileges can leverage this vulnerability to access and manipulate internal services, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References