What’s Vulnerable › Vulnerabilities

CVE-2023-1273: ND Shortcodes < 7.0 - Subscriber+ LFI

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-04 · updated 2026-06-17

Description

The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks

Affected products

• ND Shortcodes: before 7.0 — fixed in 7.0

How to fix

Upgrade to a fixed version: ND Shortcodes 7.0. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/0805ed7e-395d-48de-b484-6c3ec1cd4b8e
• https://wpscan.com/vulnerability/0805ed7e-395d-48de-b484-6c3ec1cd4b8e

Get alerted when CVE-2023-1273 or the next vulnerability affects your stack