CVE-2025-12800

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12800", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-06T12:02:44.591Z", "datePublished": "2025-11-23T22:26:39.686Z", "dateUpdated": "2026-04-08T16:55:40.023Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:40.023Z"}, "affected": [{"vendor": "gn_themes", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers"}], "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb7db4-bef7-4799-9b65-ebe77976e21c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397946/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "GABRIEL GERALDINO DE SOUZA"}], "timeline": [{"time": "2025-10-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-06T12:18:21.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-23T10:11:05.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T17:19:34.930874Z", "id": "CVE-2025-12800", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T17:19:43.962Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12800", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T17:19:34.930874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T17:19:39.758Z"}}], "cna": {"title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "GABRIEL GERALDINO DE SOUZA"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "gn_themes", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.4.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-06T12:18:21.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-23T10:11:05.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb7db4-bef7-4799-9b65-ebe77976e21c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397946/"}], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:40.023Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12800", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:55:40.023Z", "dateReserved": "2025-11-06T12:02:44.591Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-23T22:26:39.686Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "vendor": "gn_themes", "versions": [{"lessThanOrEqual": "7.4.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.4.5 via the su_shortcode_csv_table function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. If the 'Unsafe features' option is explicitly enabled by an administrator, this issue becomes exploitable by Contributor+ attackers"}, {"lang": "es", "value": "El plugin WP Shortcodes Plugin - Shortcodes Ultimate para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 7.4.5, inclusive, a trav\u00e9s de la funci\u00f3n su_shortcode_csv_table. Esto permite a atacantes autenticados, con acceso de nivel de Administrador o superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos. Si la opci\u00f3n 'Unsafe features' es habilitada expl\u00edcitamente por un administrador, este problema se vuelve explotable por atacantes con rol de Colaborador o superior."}], "id": "CVE-2025-12800", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12800", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T17:19:34.930874Z", "version": "2.0.3"}}]}, "published": "2025-11-23T23:15:45.983", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3397946/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb7db4-bef7-4799-9b65-ebe77976e21c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:27:13.107854+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Shortcodes Plugin \u2013 Shortcodes Ultimate to version 7.4.6 or later to remove the SSRF flaw.", "In the plugin settings, disable the \"Unsafe features\" option to prevent the flaw from being reachable by contributors or lower\u2011privileged roles.", "Remove or restrict Administrator and Contributor accounts that are not required for normal operation, and enforce a least\u2011privilege model for all WordPress users."], "summary": {"action": "Immediate Patch", "impact": "Server\u2011Side Request Forgery with administrator\u2011level access"}, "threat_synthesis": {"affected_systems": "GN Themes distributes the WP Shortcodes Plugin \u2013 Shortcodes Ultimate for WordPress. All packaged releases through version 7.4.5 are affected; newer releases are not listed as vulnerable. The vulnerability applies exclusively to installations utilizing the affected plugin on a WordPress installation.", "description_and_impact": "The WP Shortcodes Plugin \u2013 Shortcodes Ultimate contains a server\u2011side request forgery flaw in the su_shortcode_csv_table shortcode. The callable function accepts arbitrary URLs supplied by the user and retrieves them without proper filtering, allowing an attacker to direct the vulnerable WordPress instance to any network location. Because the misuse of the shortcode occurs only when a logged\u2011in user with Administrator or higher privileges (or Contributor visibility if the \"Unsafe features\" option is enabled) creates the shortcode, the integrity and confidentiality of internal or external services can be affected. The flaw is classified as CWE\u2011918.", "risk_and_exploitability": "The CVSS score of 6.4 classifies the vulnerability as medium severity, yet the EPSS score of less than 1% indicates a low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog, further reducing perceived widespread use. However, authenticated attackers with the required privilege level can request any internal network address from the server, facilitating data exfiltration or manipulation of internal services. If the \"Unsafe features\" setting is enabled, even users with Contributor or higher privileges can exploit the flaw, expanding the potential attack surface. Overall, the risk remains medium, but mitigation should occur promptly to prevent potential internal network exposure."}}}}, "created": "2025-11-25T11:02:36.411186+00:00", "updated": "2026-04-22T00:30:04.054808+00:00", "vendors": ["gn_themes", "gn_themes$PRODUCT$wp_shortcodes_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}