CVE-2023-0340

CVE-2023-0340 affects the Custom Content Shortcode WordPress plugin through version 4.0.2, stemming from a lack of validation in a shortcode attribute. This vulnerability allows authenticated users with contributor roles or higher to perform arbitrary file inclusion via a traversal attack, potentially leading to the disclosure of non-PHP file content. With a CVSS score of 8.8 (HIGH), the attack complexity is low, and successful exploitation could result in high impact to confidentiality, integrity, and availability, including potential Remote Code Execution if an attacker can upload and include malicious PHP code. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.