WordPress Vulnerability In Shortcodes Ultimate Impacts 700,000 Sites 

[{"selector":"#anim-7a01601b-c832-4851-a957-abc02e7be904","keyframes":[{"transform":"scale(1)","offset":0},{"transform":"scale(1.05)","offset":0.33},{"transform":"scale(0.995)","offset":0.66},{"transform":"scale(1)","offset":1}],"delay":0,"duration":600,"easing":"ease-in-out","fill":"both","iterations":3}]

Popular WordPress plugin Ultimate Shortcodes used in over 700,000 WordPress websites contains a CSRF vulnerability.

[{"selector":"#anim-8533526a-63b2-4af8-9f5c-1f3a84f0a839","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-cfca83c8-4dab-42f1-8cd3-9c1e42adf92b","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-98f121c7-0890-4391-9d8b-4421fab01aba","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

The United States government National Vulnerability Database (NVD) published an advisory about Shortcodes Ultimate WordPress plugin.

[{"selector":"#anim-21937519-0bb9-4d50-9044-91e94168c67c","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0f7f3a68-d6cf-4a84-96b2-215e1a334e8f","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-297e0621-ee8c-4d6f-975d-cd3487828b06","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Warning that it was discovered to contain a Cross Site Request Forgery vulnerability.

[{"selector":"#anim-c6c3ef83-38e0-4dc3-81a2-41b5306e112d","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-55a03fa4-f3ba-421b-901d-c29489d44327","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4ea9cfa5-6185-4c56-901b-7b943ab4f0d0","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Shortcodes Ultimate is a highly popular WordPress plugin that has over 700,000 active installations.

[{"selector":"#anim-7912e7f4-642f-475d-af5e-32fc5ba045c4","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-964e1a1c-0fe0-4581-8792-8c682bd33df1","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e8ca7c33-9b8b-414d-9cca-32258de80b46","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

The vulnerability affects plugin versions that are older than the current version 5.12.2.

[{"selector":"#anim-148da513-4487-4381-8b04-7f23670c6439","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e65b157a-65c0-4807-ac5d-451023791d51","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b70a4db8-7b42-4207-bec9-bb53a0c4922d","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

Cross-Site Request Forgery, commonly referred to as CSRF, is a type of vulnerability that can in the worst cases can lead to complete website takeover.

[{"selector":"#anim-a196754e-e26c-463d-8fda-f25e3ab95944","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b9a796c9-644a-4a87-a3a0-716b487ca0f3","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-79349d4a-0813-4cf4-99c4-f275a4a8f6e7","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

These kinds of vulnerabilities are generally caused by targeting a flaw in software that can trigger a change, which can then lead to unintended consequences.

[{"selector":"#anim-794a9633-c14a-40b4-be74-c938a3122bce","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3c9ec545-6aa0-4047-a70a-600cc2e2fe37","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b20037e4-141b-4492-8871-e1d4df4e22d6","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

A successful attack generally depends on a user, for example with administrative privileges

[{"selector":"#anim-11eab442-11dd-44e4-a87a-c132bf1aa805","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e1052160-0f98-431a-a85e-e635f1ba692b","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-073d07e7-1733-447b-bd8e-80a14995d76a","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]

This kind of vulnerability depends on social engineering, which is manipulating an end user to complete an action which then takes advantage of the plugin vulnerability.

[{"selector":"#anim-925c4a39-5cb9-43c0-9808-79a8741f1463","keyframes":{"transform":["translate3d(-112.12121%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b78105f8-23ad-4952-bd0b-6ac9e325dc9e","keyframes":{"opacity":[0,1]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8f8f1c36-23af-41be-b3ac-713a5aee382a","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":550,"duration":500,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}]