CVE-2023-6991 is a server-side request forgery in the JSM file_get_contents() Shortcode WordPress plugin before 2.7.1. The record scores it 8.8 (High) and WPScan scores it 4.1 (medium). Update to 2.7.1 or later. Check which roles on your site can use the shortcode, and update.
What's affected
The record and WPScan agree that versions before 2.7.1 are affected and that 2.7.1 is the fixed version. They disagree on severity: the record gives CVSS 8.8 High and WPScan gives 4.1 medium. Both numbers are reported here.
Users with the contributor role and above can use the shortcode, so sites that let outsiders sign up as contributors or authors are more exposed.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-file-get-contents --field=version
Any version below 2.7.1 is affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update wp-file-get-contents, or use the Plugins screen. The fixed version is 2.7.1. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Limit who holds contributor or author roles, and block outbound requests to internal addresses from the web server where possible.
Why it matters
The description says the shortcode makes a request to a URL without validating the parameter. That lets a contributor make the web server fetch addresses the contributor could not reach, such as internal services or cloud metadata endpoints. The record tags CWE-918.
SSRF is dangerous in cloud environments, where internal metadata services can hand out credentials. Allow lists for destinations, blocking private address ranges, and egress filtering are the usual defenses.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-918 (Server-Side Request Forgery).
Quick check
What can SSRF reach?
Anything the server can reach, including internal admin panels and cloud metadata services. Egress controls reduce the blast radius.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
