CVE-2023-25050: 
WordPress vulnerability analysis and mitigation

The Shortcodes Ultimate WordPress plugin versions through 5.12.6 contains a Path Traversal vulnerability (CVE-2023-25050). This security issue allows authenticated users with a minimum Contributor role to perform arbitrary file downloads through path traversal. The vulnerability was discovered in February 2023 and was patched in version 5.12.7 (Patchstack Article).

The vulnerability exists in the table shortcode functionality within the su_shortcode_table function. The code accepts a URL parameter and uses PHP's file function to fetch content, which can be exploited to read local files. The vulnerability received a CVSS v3.1 score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N (Patchstack Database).

The vulnerability allows authenticated attackers to download any file from the website, including sensitive files containing login credentials or backup files. This could lead to unauthorized access to confidential information and potential system compromise (Patchstack Database).

The vulnerability requires an authenticated user with at least Contributor privileges to exploit. The attack can be launched remotely by manipulating the URL parameter in the table shortcode functionality (Patchstack Article).

The vulnerability has been patched in Shortcodes Ultimate version 5.12.7. Users are strongly advised to update to this version or later to resolve the security issue. Patchstack has also issued a virtual patch to mitigate this issue by blocking attacks until users update to the fixed version (Patchstack Database).