CVE-2023-0890

The Shortcodes Ultimate plugin versions prior to 5.12.8 fail to verify that posts displayed through certain shortcodes are publicly accessible or that the requesting user has permission to view them, enabling any authenticated user with a subscriber role or higher to access draft, private, and password-protected posts. Additionally, the vulnerability permits exposure of passwords associated with protected posts.

Based on public CVE data (MITRE/NVD).