CVE-2023-5974
CVE-2023-5974 is a critical-severity vulnerability in Wpb Show Core Project Wpb Show Core with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 3% (86th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-918
- Affected product: Wpb Show Core Project Wpb Show Core
- Published:
- Last modified:
Description
The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.
Frequently asked questions
- What is CVE-2023-5974?
- The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.
- How severe is CVE-2023-5974?
- CVE-2023-5974 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2023-5974 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (86th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-5974?
- CVE-2023-5974 affects Wpb Show Core Project Wpb Show Core. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-5974?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2023-5974 published?
- CVE-2023-5974 was published on 2023-11-27 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:wpb_show_core_project:wpb_show_core:*:*:*:*:*:wordpress:*:*
More vulnerabilities in Wpb Show Core Project Wpb Show Core
- CVE-2023-4922 — Critical (CVSS 9.8): The WPB Show Core WordPress plugin through 2.2 is vulnerable to a local file inclusion via the `path` parameter.
- CVE-2024-1956 — Medium (CVSS 6.1): The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in…
- CVE-2022-3484 — Medium (CVSS 6.1): The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page,…
- CVE-2024-1958 — Medium (CVSS 4.8): The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the…
- CVE-2024-1292 — Medium (CVSS 4.7): The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back…
All CVEs affecting Wpb Show Core Project Wpb Show Core →
Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities
- CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
- CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
- CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
- CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
- CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
- CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…
Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →