CVE-2023-0340: high-severity vulnerability in Custom Content Shortcode
Custom Content Shortcode <= 4.0.2 - Contributor+ LFI
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.0%
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Custom Content ShortcodeRelated CVEs — Custom Content Shortcode
In the same product, most dangerous first.
CVE-2021-24824—Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata AccessEPSS 0.8%CVE-2021-24826—Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-0273MEDIUMCustom Content Shortcode <= 4.0.2 - Contributor+ Stored XSSEPSS 0.4%CVE-2021-24825—Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFIEPSS 0.4%