CVE-2025-1119
Published: 13 March 2025
Summary
CVE-2025-1119 is a high-severity Code Injection (CWE-94) vulnerability in Com (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions through 1.6.8.5. The flaw stems from insufficient validation of a supplied value prior to invoking the do_shortcode function, which is tracked as CVE-2025-1119 and assigned CWE-94 with a CVSS 3.1 base score of 7.3.
Unauthenticated attackers can exploit the issue remotely by supplying crafted input that triggers execution of arbitrary shortcodes. Successful exploitation yields limited effects on confidentiality, integrity, and availability without requiring user interaction or authentication.
References point to a committed patch in the plugin's booking-app-new/page-appointment-edit.php file and to Wordfence threat intelligence entries that document the remediation. Site administrators should apply the available update from the WordPress plugin repository to eliminate the unsafe shortcode invocation.
The associated EPSS score rose from a low baseline to a peak of 0.0169 on 2026-04-09 before receding, indicating that exploitation interest materialized after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6257
Vulnerability details
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that…
more
does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables remote exploitation of a public-facing WordPress application through unauthenticated arbitrary shortcode execution via improper input validation before do_shortcode.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of information inputs at defined points, directly addressing the lack of validation before do_shortcode execution that enables arbitrary shortcode injection.
SI-2 requires timely remediation of flaws, mitigating this specific vulnerability through application of the available plugin patch that fixes the validation issue.
RA-5 ensures regular vulnerability scanning to identify flaws like improper input validation in plugins, enabling proactive detection and patching.