CVE-2023-0911

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p49

Published

Mar 20, 2023 (Mar 20, 2023)

Modified

Jun 17, 2026

Description

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.

Vendors: getshortcodes
Products: shortcodes ultimate
Ecosystems: WordPress
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.