{"id":"CVE-2023-6991","aliases":["EUVD-2023-59183","GHSA-r69x-4mjc-6rq7"],"status":"published","title":"JSM file_get_contents() Shortcode \u003c 2.7.1 - Contributor+ SSRF","description":"The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00694,"percentile":0.53218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2024-01-15T15:10:41Z","modified":"2026-06-17T06:51:49Z","products":[{"vendor":"js morisset","product":"jsm file_get_contents() shortcode"},{"vendor":"surniaulula","product":"jsm_file_get_contents\\(\\)_shortcode"},{"vendor":"unknown","product":"jsm file_get_contents() shortcode"}],"references":[{"url":"https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bc","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6991"},{"url":"https://github.com/advisories/GHSA-r69x-4mjc-6rq7"}],"sources":{"cve":[{"id":"CVE-2023-6991","title":"JSM file_get_contents() Shortcode \u003c 2.7.1 - Contributor+ SSRF","description":"The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.","status":"published","published":"2024-01-15T15:10:41.733Z","modified":"2025-06-11T16:42:03.11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-59183","description":"The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.","status":"published","published":"2024-01-15T15:10:41Z","modified":"2025-06-11T16:42:03Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:24.98161Z"}],"ghsa":[{"id":"GHSA-r69x-4mjc-6rq7","title":"The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its...","description":"The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.","status":"published","published":"2024-01-15T18:30:18Z","modified":"2024-01-31T05:07:18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:55:30.717237Z"}],"nvd":[{"id":"CVE-2023-6991","description":"The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.","status":"published","published":"2024-01-15T16:15:12.743Z","modified":"2026-06-17T06:51:49.747Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}