Vulnerabilities > CVE-2023-6969 - Authorization Bypass Through User-Controlled Key vulnerability in Kylebjohnson User Shortcodes Plus

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE
network
low complexity
kylebjohnson
CWE-639
NVD
Published: 2024-03-13
Updated: 2025-02-07

Summary

The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the user_meta shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve potentially sensitive user meta.

Vulnerable Configurations

Part Description Count
Application
Kylebjohnson
1

Common Weakness Enumeration (CWE)

References