CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vova Anokhin Shortcodes Ultimate allows Absolute Path Traversal.This issue affects Shortcodes Ultimate: from n/a through 5.12.6.
Explanation of Vulnerability in Simple Terms
Shortcodes Ultimate versions up to 5.12.6 contain a path traversal vulnerability that allows authenticated users with low privileges to read files outside the intended directory. The vulnerability stems from insufficient validation of file paths. An attacker can access sensitive files on the server, potentially exposing configuration data or other protected content.
What an attacker can do
Read arbitrary files from the server outside the plugin's intended directory.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed to authenticated users.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; no user interaction required.
Key dates
External resources
Related vulnerabilities
