CVE-2023-6991

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Unknown	JSM file_get_contents() Shortcode	< 2.7.1

References

https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bcExploit, Third Party Advisory
https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bcExploit, Third Party Advisory

Timeline

Published: Jan 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-69925.5Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (CVE-2023-69936.4The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and CVE-2023-69946.4The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versio CVE-2023-69968.8The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin CVE-2023-69987.7Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue CVE-2023-69998.8The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to,CVE-2023-70027.2The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' p CVE-2023-70036.8The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to CVE-2023-70046.5The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for conn CVE-2023-70057.5A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilize CVE-2023-70069.1The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks int CVE-2023-70078.2Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unl