The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Shortcodes Ultimate Plugin | — | Update shortcodes-ultimate plugin to version 5.12.8, or a newer patched version | May 15, 2025 | Feb 27, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub