WordPress Plugin Vulnerabilities

Forget About Shortcode Buttons <= 2.1.3 - Missing Authorization

Description

The Forget About Shortcode Buttons plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
forget-about-shortcode-buttons
No known fix

References

CVE
CVE-2025-63041
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fd2fed79-3ed2-4a05-b0b1-e902f53a1933

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
69a23f4b-eb1a-43e3-8fcf-5df75cf74939

Timeline

Publicly Published
2026-06-26 (about 1 month ago)
Added
2026-06-29 (about 1 month ago)
Last Updated
2026-06-29 (about 1 month ago)

Other

Published
Title
Published
2026-05-13
Title
InfusedWoo Pro < 5.1.3 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters
Published
2025-09-03
Title
Malcure Malware Scanner < 16.9 - Missing Authorization
Published
2026-01-03
Title
Prowess <= 1.8.1 - Missing Authorization
Published
2023-10-11
Title
IMPress Listings <= 2.6.2 - Missing Authorization
Published
2022-07-26
Title
Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation