CVE-2023-6226

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
gn_themes	WP Shortcodes Plugin — Shortcodes Ultimate	<= 5.13.3

References

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62283.3An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based b CVE-2023-62299.8Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on CVE-2023-62309.8Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser CVE-2023-62319.8Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwo CVE-2023-62329.8Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser CVE-2023-62339.8Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the n CVE-2023-62349.8Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attack CVE-2023-62357.8An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could p CVE-2023-62367.3A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second t CVE-2023-62375.9Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function E CVE-2023-62386.7A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small m CVE-2023-62398.8Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of