CVE-2023-6969

2024-03-1316:15:09

[email protected]

web.nvd.nist.gov

cve-2023-6969

user shortcodes plus

wordpress

insecure direct object reference

vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the user_meta shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve potentially sensitive user meta.

Affected configurations

Vulners

Node

kbjohnson90user_shortcodes_plusRange≤2.0.2

CNA Affected

[
  {
    "vendor": "kbjohnson90",
    "product": "User Shortcodes Plus",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.0.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]