CVE-2025-2809

Vulnerability

The azurecurve Shortcodes in Comments plugin for WordPress, in all versions up to and including 2.0.2, contains a vulnerability that permits arbitrary shortcode execution. The flaw lies in the plugin's failure to properly validate user-supplied data before passing it to the do_shortcode function, allowing unsanitized input to be processed as shortcode syntax [1].

Exploitation

An unauthenticated attacker can exploit this by submitting specially crafted content through any input that the plugin processes, such as comment fields. No authentication or elevated privileges are required. The attacker simply needs to inject malicious shortcode syntax into the vulnerable field, which the plugin then executes without prior validation [1].

Impact

Successful exploitation allows the attacker to execute arbitrary shortcodes available within the WordPress installation. This can lead to a range of adverse effects, including data exposure, privilege escalation, or even remote code execution if installed shortcodes permit file manipulation or command execution. The exact impact depends on the shortcodes registered by other plugins or themes [1].

Mitigation

The plugin has been closed on the WordPress plugin repository as of April 9, 2025, due to this security issue [1]. Users are strongly advised to remove the plugin immediately. No patched version is available; the only mitigation is to uninstall the plugin.