CVE-2024-11733

CVE-2024-11733 is an arbitrary shortcode execution vulnerability (CWE-94) in the WordPress Popular Posts plugin for WordPress, affecting all versions up to and including 7.1.0. The issue stems from the plugin allowing execution of an action that fails to properly validate a value prior to invoking the do_shortcode function, enabling unauthenticated attackers to run arbitrary shortcodes. The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. By targeting the insufficiently validated input, they can execute arbitrary shortcodes, potentially resulting in low-level impacts to confidentiality, integrity, and availability, such as data disclosure, modification, or denial of service within the affected WordPress site.

Advisories and mitigation details are provided by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/c38ac8d6-c6de-4be7-bf7b-198e085a0ad2?source=cve. The vulnerable code is visible in the plugin source at https://plugins.trac.wordpress.org/browser/wordpress-popular-posts/tags/7.1.0/src/Rest/ViewLoggerEndpoint.php#L70, where the lack of validation occurs prior to do_shortcode execution.