Discussion Board CVE-2025-8483

Requires an authenticated account with Subscriber-level access or above on a site running the Discussion Board - WordPress Forum Plugin at version 2.5.5 or earlier; the specific prerequisite is reaching the plugin action that passes an unvalidated user-supplied value into WordPress's do_shortcode() function. Limiting factors: exploitation is impossible without a valid low-privilege account, so sites that disallow open user registration materially reduce exposure, and the real-world impact is bounded by which shortcodes are actually registered on the target site (so escalation to code execution is conditional, not guaranteed). No user interaction from an admin is needed (UI:N).

This is a moderate-risk, authenticated vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 6.3) indicates network-reachable, low-complexity exploitation requiring only Subscriber-level authentication (PR:L) with no user interaction, but each impact dimension is only Low - consistent with arbitrary shortcode execution whose blast radius depends on which shortcodes are available in the environment rather than guaranteed full compromise. Exploitation signals are weak: EPSS is 0.26% (17th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so this is not evidence of widespread or imminent mass exploitation. The 'RCE' tag overstates the confirmed impact - the description and CWE-94 describe arbitrary shortcode execution, which only escalates to code execution if a dangerous shortcode happens to be registered on the site; treat 'RCE' as a worst-case label, not a confirmed outcome. Net: a real but lower-priority issue for sites running this plugin that allow untrusted user registration, warranting patching in normal cycles rather than crisis response.

An attacker registers or already holds a low-privilege Subscriber account on a WordPress site running the Discussion Board plugin (≤2.5.5). They invoke the vulnerable plugin action with a crafted value that is passed to do_shortcode without proper validation, causing arbitrary shortcodes to be rendered and executed in the application context. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once an account exists.