CVE-2025-7369
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.
Analysis
Execute arbitrary shortcodes in WordPress sites running WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.2 via Cross-Site Request Forgery targeting site administrators. Unauthenticated attackers can forge requests that bypass nonce validation in the preview function, allowing execution of arbitrary shortcodes if an admin clicks a malicious link. When combined with CVE-2025-7354, this enables Reflected Cross-Site Scripting. EPSS score of 6.1 (moderate CVSS) reflects the UI requirement and need for admin interaction, though real-world risk is elevated due to the attack surface in WordPress admin workflows. No public exploit code or CISA KEV confirmation identified at time of analysis.
Technical Context
The vulnerability stems from missing or incorrect nonce validation (CWE-352: Cross-Site Request Forgery) in the plugin's preview function, which processes shortcodes without verifying the WordPress security token. The affected code resides in the generator.php file at line 339 within the preview endpoint. Nonces in WordPress are cryptographic tokens bound to user sessions and actions; their absence allows an attacker to construct a forged HTTP request that, when initiated by an authenticated admin user, executes arbitrary shortcodes server-side. The plugin processes user-supplied shortcode parameters without adequate CSRF protection, making the preview function a vector for unauthorized shortcode execution. Shortcodes in WordPress are a templating mechanism that expands to dynamic content; malicious shortcodes can trigger embedded code execution depending on the shortcode handler implementation.
Affected Products
WP Shortcodes Plugin - Shortcodes Ultimate for WordPress is vulnerable in all versions up to and including 7.4.2. The affected product is typically installed via the WordPress plugin repository. According to the WordPress Trac browser reference and changeset 3328729, the vulnerability exists in the core generator.php file used across the affected version range. Organizations running any version of this plugin at or below 7.4.2 should be considered in scope. The exact CPE for this WordPress plugin would be cpe:2.4:a:vladvader:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*.
Remediation
The primary remediation is to upgrade WP Shortcodes Plugin - Shortcodes Ultimate to a patched version beyond 7.4.2. Vendors typically release security updates on the WordPress plugin repository; site administrators should navigate to Plugins → Installed Plugins in their WordPress dashboard, locate Shortcodes Ultimate, and install any available update. Per the WordPress Trac changeset 3328729 reference, the upstream fix has been committed. Until patching is possible, as a temporary mitigation, site administrators can disable the shortcodes preview function or restrict access to the plugin settings to trusted users only, though this may impact plugin functionality. For detailed remediation guidance and to confirm the exact patched version, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd and the CleanTalk research at https://research.cleantalk.org/cve-2025-7369/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today