WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
Shortcodes Ultimate plugin before 5.0.1 for WordPress contains a remote code execution caused by a filter in meta, post, or user shortcode, letting remote attackers execute arbitrary code, exploit requires sending crafted shortcode data. References: https://wpscan.com/vulnerability/efad59c8-e6ae-4167-9c78-d3ea52fe5bba/ https://plugins.trac.wordpress.org/changeset/1756323/shortcodes-ultimate https://blog.sucuri.net/2017/11/formidable-forms-shortcodes-ultimate-exploits-in-the-wild.html https://nvd.nist.gov/vuln/detail/CVE-2017-18580 Remediation: Update to version 5.0.1 or later.
10 assets checked · domain, subdomain, ipv4