CVE-2023-0340 Custom Content Shortcode <= 4.0.2 - Contributor+ LFI
Contributors can exploit a path traversal vulnerability in the Custom Content Shortcode plugin to read arbitrary files or achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0340?
CVE-2023-0340 is a high-severity path traversal vulnerability in Unknown Custom Content Shortcode, published on 20 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Which versions are affected by CVE-2023-0340?
It affects 1 product.
Products include Custom Content Shortcode Project Custom Content Shortcode.
How do I fix CVE-2023-0340?
No fix has been published for CVE-2023-0340 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-0340 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0340 exists.
Other vulnerabilities in Unknown Custom Content Shortcode
- CVE-2023-0273 Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS
- CVE-2021-24826 Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting
- CVE-2021-24824 Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
- CVE-2021-24825 Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI
Sources
Also known as GHSA-q9rp-c9pw-fg3v.