CVE-2023-0911 Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure

2023-03-2015:52:23

WPScan

www.cve.org

wordpress

shortcodes ultimate

user meta disclosure

cve-2023-0911

plugin vulnerability

0.001 Low

EPSS

Percentile

29.7%

JSON

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WordPress Shortcodes Plugin — Shortcodes Ultimate",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "5.12.8"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444

0.001 Low

EPSS

Percentile

29.7%

JSON

Related for CVELIST:CVE-2023-0911