WP Shortcodes Plugin — Shortcodes Ultimate, CVE-2023-0911

CVE, Research URL: CVE-2023-0911
Home page URL: Security reports for WP Shortcodes Plugin — Shortcodes Ultimate
Application: WP Shortcodes Plugin — Shortcodes Ultimate
Published on: Mar 20, 2023
Research Description: The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
Affected versions: Min -, max 5.12.8.
Status: vulnerable