CVE-2024-11976
Published: 23 January 2026
Summary
CVE-2024-11976 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-11976 is an arbitrary shortcode execution vulnerability in the BuddyPress plugin for WordPress, affecting all versions up to and including 14.3.3. The issue stems from an AJAX action that fails to properly validate a user-supplied value before passing it to the do_shortcode function, enabling execution of arbitrary shortcodes. It is classified under CWE-94 (Improper Control of Generation of Code) with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction or privileges required. By sending a crafted request to the affected AJAX endpoint, they can execute arbitrary shortcodes, potentially compromising low levels of confidentiality, integrity, and availability on the targeted WordPress site.
Advisories and plugin repository references indicate mitigation through updating BuddyPress to a version beyond 14.3.3. The vulnerable code is located in bp-templates/bp-nouveau/includes/messages/ajax.php at line 232 in the 14.3.1 tag, with a fix applied in trunk changeset 3259392. Additional details are available on the Wordfence threat intelligence page for this vulnerability ID.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4426
Vulnerability details
The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before…
more
running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of a public-facing WordPress plugin via crafted AJAX request to invoke arbitrary shortcodes (CWE-94).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied values before they are used in dangerous operations such as do_shortcode, eliminating the root cause of the unauthenticated shortcode execution.
Mandates timely application of patches that correct the missing input validation in the BuddyPress AJAX handler (fixed after 14.3.3).
Enforces access-control decisions on the vulnerable AJAX endpoint so that only authenticated and authorized users may invoke the shortcode-execution action.