Shortcode Ajax CVE-2025-14539

Exploitation requires the Shortcode Ajax plugin (version 1.0 or earlier) to be installed and active on a WordPress site, and the plugin's AJAX action that calls do_shortcode on unvalidated input to be reachable. The practical impact is strictly bounded by which shortcodes are registered on the target: 'arbitrary shortcode execution' only escalates to meaningful code execution or sensitive data exposure if a powerful or dangerous shortcode (e.g., one that runs PHP, queries data, or performs privileged actions) exists on the site; on a site with only benign display shortcodes, impact is limited. A key limiting/ambiguous factor is authentication: the description implies no authentication is needed, but the provided CVSS vector (PR:L) implies a logged-in low-privilege account is required - defenders should confirm this, as it materially changes exposure.

This is a moderate-priority issue that does not rise to emergency patching urgency despite the 'RCE' tag. The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4 Medium) indicates a network-reachable, low-complexity flaw with only Low confidentiality and integrity impact and no availability impact. There is a CLEAR CONFLICT in the source data: the description states 'unauthenticated attackers' can exploit it, yet the provided CVSS vector encodes PR:L (requiring low-privilege authentication) - these cannot both be literally true, and this should be verified with Wordfence/the vendor. EPSS is low at 0.29% (20th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. Taken together, the signals point to a real but non-critical vulnerability: easy to trigger if reachable, but limited impact per the CVSS scope (S:U) and bounded by whatever shortcodes are actually installed on the target. The 'RCE' tag likely overstates impact - arbitrary shortcode execution only yields code execution if a dangerous shortcode (e.g., one allowing PHP or command execution) happens to be registered on the site.

An attacker sends a crafted AJAX request to the vulnerable action exposed by the Shortcode Ajax plugin (versions ≤ 1.0), supplying attacker-controlled input that is passed to do_shortcode without validation. Because the plugin executes the supplied value as a WordPress shortcode, the attacker can invoke any shortcode registered on the site - potentially exposing restricted content, triggering unintended actions, or, if a code-executing shortcode is present, achieving code execution. No public exploit code is referenced, and the attack requires only low complexity over the network.