cve/2023/CVE-2023-6991.md

### [CVE-2023-6991](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6991)
![](https://img.shields.io/static/v1?label=Product&message=JSM%20file_get_contents()%20Shortcode&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.7.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brighgreen)

### Description

The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.

### POC

#### Reference
- https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bc

#### Github
No PoCs found on GitHub currently.