Vulnerability · Published Mar 20, 2023 · Assigned by WPScan
CVE-2023-0890Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access
Medium 6.5
In plain English
A medium-severity security flaw in WordPress Shortcodes Plugin — Shortcodes Ultimate from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WordPress Shortcodes Plugin — Shortcodes Ultimate | 0 – before 5.12.8 |
References
- https://wpscan.com/vulnerability/8a466f15-f112-4527-8b02-4544a8032671 exploit, vdb-entry, technical-description