The WP Shortcodes Plugin – Shortcodes Ultimate contains a server‑side request forgery flaw in the su_shortcode_csv_table shortcode. The callable function accepts arbitrary URLs supplied by the user and retrieves them without proper filtering, allowing an attacker to direct the vulnerable WordPress instance to any network location. Because the misuse of the shortcode occurs only when a logged‑in user with Administrator or higher privileges (or Contributor visibility if the "Unsafe features" option is enabled) creates the shortcode, the integrity and confidentiality of internal or external services can be affected. The flaw is classified as CWE‑918.

GN Themes distributes the WP Shortcodes Plugin – Shortcodes Ultimate for WordPress. All packaged releases through version 7.4.5 are affected; newer releases are not listed as vulnerable. The vulnerability applies exclusively to installations utilizing the affected plugin on a WordPress installation.

The CVSS score of 6.4 classifies the vulnerability as medium severity, yet the EPSS score of less than 1% indicates a low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog, further reducing perceived widespread use. However, authenticated attackers with the required privilege level can request any internal network address from the server, facilitating data exfiltration or manipulation of internal services. If the "Unsafe features" setting is enabled, even users with Contributor or higher privileges can exploit the flaw, expanding the potential attack surface. Overall, the risk remains medium, but mitigation should occur promptly to prevent potential internal network exposure.