Threats tagged 'ghsa-7vx4-j234-7f53'

The WP Shortcodes Plugin (Shortcodes Ultimate) for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in the su_shortcode_csv_table function affecting all versions up to and including 7.4.5. Authenticated users with Administrator-level access can exploit this flaw to make arbitrary web requests from the server, potentially accessing or modifying internal services. If the 'Unsafe features' option is enabled by an administrator, users with Contributor-level access or higher can also exploit this vulnerability.