CVE-2025-1509
Published: 22 February 2025
Description
The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Security Summary
CVE-2025-1509 is an arbitrary shortcode execution vulnerability in the Show Me The Cookies plugin for WordPress, affecting all versions up to and including 1.0. The issue stems from the plugin allowing execution of an action that fails to properly validate a value prior to invoking the do_shortcode function, enabling attackers to inject and run arbitrary shortcodes. Published on 2025-02-22, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-94 (Improper Control of Generation of Code).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation allows execution of arbitrary shortcodes on the target WordPress site, potentially compromising low levels of confidentiality, integrity, and availability as per the CVSS metrics.
Mitigation guidance is available in advisories from Wordfence and the plugin's listing on WordPress.org, accessible at https://www.wordfence.com/threat-intel/vulnerabilities/id/65d15ceb-ab39-4088-a289-7244063aedf8?source=cve and https://wordpress.org/plugins/show-me-the-cookies/.
Details
- CWE(s)