Shortcodes Ultimate < 5.12.7 - Subscriber+ SSRF

The plugin does not validate the url attribute of its su_csv_table shortcode before making a request to it, which could allow any authenticated users, such as subscriber to perform SSRF attacks