CVE-2023-37888 is a high severity (CVSS 7.6) path traversal flaw in the Shortcodes and extra features for Phlox theme plugin by Averta, through 2.14.0. It allows PHP local file inclusion, where the site loads a file it should not. Update to the latest release and confirm the fixed version in the vendor notes.
What's affected
The NVD record lists Shortcodes and extra features for Phlox theme as affected "from n/a through 2.14.0", which is Patchstack wording for every release up to and including 2.14.0. The record scores the flaw 7.6 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. The weakness is tracked as CWE-22 (path traversal).
Here the sources disagree on one point, so read both. The record gives the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, which includes PR:L, meaning a low privilege account. The Patchstack reference the record links to has a title that says "unauthenticated local file inclusion", though we could not load the page to read its details. If the page is right, no account is needed. Plan for the worse case, which is no login.
The record names no fixed version, and the Patchstack page it links to could not be retrieved when we reviewed it (Patchstack blocked our request). The CVE is not flagged in CISA KEV in the record, and nothing we read says it is exploited in the wild. For the fixed release, check the vendor changelog or the Patchstack entry.
How to check if you're exposed
If you run WP-CLI, list the installed version and status of the plugin:
wp plugin list --fields=name,version,status,update
Look for Shortcodes and extra features for Phlox theme in the output. Anything at 2.14.0 or lower is in the affected range. In the dashboard the same information is under Plugins, Installed Plugins. On a fleet of sites, run the command per site or through your management tool, and include staging and forgotten test copies.
You can also check your dependency manifests and images. A free in-browser scan at gold.safeguard.sh/scan takes a package.json, a requirements.txt or an SBOM and shows known CVEs, though WordPress plugins are usually tracked by the CMS rather than a package manager, so keep a separate list of them.
What to do now
- List every WordPress site you run and note whether Shortcodes and extra features for Phlox theme is installed and at what version.
- Update Shortcodes and extra features for Phlox theme to the newest release the vendor offers. If the update is behind a license, renew it or plan the change, because the old version stays vulnerable.
- If you cannot update today, deactivate the plugin on sites where it is not needed, or restrict access to the affected features with a web application firewall rule from your provider.
- Treat the site as exposed to anonymous visitors until the vendor confirms the real prerequisite, and check web server logs for unusual requests to the plugin.
- Review user accounts and recent changes on any site that ran the affected version for a while, and remove accounts you do not recognise.
- Add the plugin to a watch list so the next advisory reaches you the day it is published.
Why it matters
Path traversal happens when a plugin builds a file path from user input and does not confine it to the intended folder. In a local file inclusion the file is then loaded by PHP, so the content of a file on the server can be read or run as part of the page. The record rates confidentiality impact high (C:H) and integrity and availability low.
Because the record says the plugin is the Phlox "core elements" add on, the risk lands on sites using the Phlox theme and its companion plugin. Scan your plugin lists for it, even on sites where the theme has been swapped out and the plugin left behind.
Try it yourself
This class of bug is visible in source code, where user input reaches a file path. The demo shows how a static scan flags it before release.
Click through it at your own pace, or open it full screen.
Quick check
Does updating Shortcodes and extra features for Phlox theme fully fix this?
The vendor decides that, and the record does not name a fixed version. Update to the latest release, read the changelog and the Patchstack entry, and confirm the version number afterwards.
Does the vector or the Patchstack title tell me the real prerequisite?
They differ. The record vector says a low privilege account is needed, while the Patchstack page title says unauthenticated. We could not read the page, so assume no login is required until the vendor says otherwise.
Sources
- Patchstack entry (linked from the NVD record; it could not be retrieved when we reviewed it)
- CVE-2023-37888 on Gold
Last reviewed: 19 October 2026.
