CVE-2025-1509
Published: 22 February 2025
Summary
CVE-2025-1509 is a high-severity Code Injection (CWE-94) vulnerability in Wpguru Show Me The Cookies. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1509 is an arbitrary shortcode execution vulnerability in the Show Me The Cookies plugin for WordPress, affecting all versions up to and including 1.0. The issue stems from the plugin allowing execution of an action that fails to properly validate a value prior to invoking the do_shortcode function, enabling attackers to inject and run arbitrary shortcodes. Published on 2025-02-22, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-94 (Improper Control of Generation of Code).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation allows execution of arbitrary shortcodes on the target WordPress site, potentially compromising low levels of confidentiality, integrity, and availability as per the CVSS metrics.
Mitigation guidance is available in advisories from Wordfence and the plugin's listing on WordPress.org, accessible at https://www.wordfence.com/threat-intel/vulnerabilities/id/65d15ceb-ab39-4088-a289-7244063aedf8?source=cve and https://wordpress.org/plugins/show-me-the-cookies/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4445
Vulnerability details
The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate…
more
a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary shortcode execution via unauthenticated remote exploitation of a public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the root cause by requiring validation and sanitization of inputs before processing with functions like do_shortcode, preventing arbitrary shortcode execution.
Mandates timely identification, reporting, and remediation of flaws such as this code injection vulnerability in the WordPress plugin via patching or upgrades.
Provides vulnerability scanning to detect the presence of the vulnerable Show Me The Cookies plugin version, enabling pre-exploitation remediation.