CVE-2023-6969
User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the user_meta shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve potentially sensitive user meta.
El complemento User Shortcodes Plus para WordPress es vulnerable a Insecure Direct Object Reference en todas las versiones hasta la 2.0.2 incluida a través del shortcode user_meta debido a la falta de validación en una clave controlada por el usuario. Esto hace posible que los atacantes autenticados, con acceso de nivel de colaborador y superior, recuperen metadatos de usuario potencialmente confidenciales.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-12-19 CVE Reserved
- 2024-02-26 CVE Published
- 2024-03-14 EPSS Updated
- 2024-10-24 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
References (2)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Kbjohnson90 Search vendor "Kbjohnson90" | User Shortcodes Plus Search vendor "Kbjohnson90" for product "User Shortcodes Plus" | <= 2.0.2 Search vendor "Kbjohnson90" for product "User Shortcodes Plus" and version " <= 2.0.2" | en |
Affected
|