CVE-2023-0911 — Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authent…
Published: 2023-03-20 · CVSS: 6.5 · CVSS 3.1
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7