Medium severity6.5NVD Advisory· Published Mar 20, 2023· Updated Jun 17, 2026

CVE-2023-0911

Description

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Getshortcodes/Shortcodes Ultimate
cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*
Range: <5.12.8
WordPress/Shortcodes Ultimatecpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <5.12.8
Package: https://wordpress.org/plugins/shortcodes-ultimate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/35404d16-7213-4293-ac0d-926bd6c17444nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000