CVE-2023-6996 is a high severity (CVSS 8.8) code injection flaw in the Display custom fields in the frontend plugin for WordPress, up to version 1.2.1. Contributors and above can call arbitrary functions through a shortcode. Update beyond 1.2.1. Check for a fixed release.
What's affected
The record says all versions up to and including 1.2.1 are affected. The flaw is in the vg_display_data shortcode, which lacks input validation and access restriction. Authenticated users with contributor-level permissions and above can exploit it.
The referenced changeset and Wordfence pages did not load for automated reading, so the fixed version is not named here. Any release above 1.2.1 is the starting point.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get shortcode-to-display-post-and-user-data --field=version
Versions up to and including 1.2.1 are affected. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update shortcode-to-display-post-and-user-data, or use the Plugins screen. Confirm the version is above 1.2.1. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Review the roles of existing contributors and authors and remove unused accounts.
Why it matters
The description says the shortcode accepts input that selects what function is called, so a contributor can call arbitrary functions and execute code. The record tags CWE-94. Shortcodes are text that content authors write into posts, so a shortcode that executes arbitrary callbacks effectively gives authors a code execution tool.
The safe design is to allow only a short fixed list of functions and to check user capabilities before any shortcode does privileged work.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-94 (Code Injection).
Quick check
Why do shortcodes cause so many flaws?
They put plugin logic in reach of content authors, who often have low privilege. If a shortcode trusts its attributes, authors can steer it.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
Last reviewed: 19 October 2026.
