PT-2023-16613 · WordPress · Shortcodes Ultimate

Erwan Lr · Published 2023-03-20 · Updated 2025-02-25 · CVE-2023-0911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Shortcodes Plugin — Shortcodes Ultimate versions prior to 5.12.8

Description The issue allows any authenticated users, such as subscribers, to retrieve arbitrary user meta, excluding the user pass, via the user shortcode. This includes sensitive information like the user email and activation key by default.

Recommendations For versions prior to 5.12.8, update to version 5.12.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the user shortcode for non-administrative users until the update is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-0911

Affected Products

Shortcodes Ultimate

References · 6

• 🔥 https://wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444 · Exploit
• https://osv.dev/vulnerability/CVE-2023-0911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0911 · Security Note
• https://t.me/cvenotify/46997 · Telegram Post
• https://t.me/cibsecurity/60343 · Telegram Post
• https://t.me/cvenotify/112483 · Telegram Post