Read the docs
TI-2023-00842 Aliases CVE-2023-0890GHSA-vmwx-8pmg-4mrr

Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post Access

Priority MEDIUM 62CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed WordPress Shortcodes Plugin — Shortcodes Ultimate (Unknown): 5.12.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWordPress Shortcodes Plugin — Shortcodes Ultimatebefore 5.12.85.12.8Patch availableCNA
  • WordPress Shortcodes Plugin — Shortcodes Ultimate VendorUnknown Affected before 5.12.8 Fixed in 5.12.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*before 5.12.8Vulnerablegn_themes
  • cpe:2.3:a:getshortcodes:shortcodes_ultimate:*:*:*:*:*:wordpress:*:* Versions before 5.12.8 Vulnerable ·gn_themes

Remediation

  • Fix · CNA WordPress Shortcodes Plugin — Shortcodes Ultimate (Unknown) Fixed in 5.12.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WordPress Shortcodes Plugin — Shortcodes Ultimate 5.12.8

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2023-00863 Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta DisclosurePriority MEDIUM 62
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0890
  2. 2026-10-03 Alias added: GHSA-vmwx-8pmg-4mrr
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2023-00863 Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta Disclosure CVSS 3.1MEDIUM 6.5
  • TI-2024-02988 Shortcodes Ultimate < 7.1.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.3
  • TI-2024-06270 Shortcodes Ultimate Pro < 7.2.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2024-02402 Shortcodes Ultimate < 7.0.5 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2017-13753 The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a… CVSS 3.0CRITICAL 9.8
  • TI-2024-03923 Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS CVSS 3.1MEDIUM 4.7
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences