CVE-2023-6969
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Summary
CVE-2023-6969 is a vulnerability affecting the User Shortcodes Plus plugin for WordPress. This issue allows authenticated attackers, with contributor-level access and above, to perform an Insecure Direct Object Reference attack using the user_meta shortcode. The lack of validation on a user-controlled key in all versions up to 2.0.2 makes sensitive user meta accessible to unauthorized individuals. This vulnerability could potentially lead to data breaches or further system compromise. WordPress users are strongly urged to update to the latest version of the plugin to mitigate the risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.