CVE-2025-2169
Published: 11 March 2025
Summary
CVE-2025-2169 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Deeper analysis
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 1.2.0.4. The issue stems from insufficient validation of an input value passed to do_shortcode, which is classified under CWE-94 and carries a CVSS 3.1 score of 7.3.
Unauthenticated attackers can exploit the flaw over the network to execute arbitrary shortcodes, potentially leading to limited impacts on confidentiality, integrity, and availability within the affected WordPress site.
References to the WordPress plugin repository show code changesets that address the validation gap, with additional details available from Wordfence threat intelligence. The associated EPSS score rose from low values to a peak of 0.0189 on 2026-02-08 before receding, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7525
Vulnerability details
The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not…
more
properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated arbitrary shortcode execution flaw in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of all inputs for correctness, consistency, and expected syntax/semantics prior to processing, directly mitigating the lack of validation before do_shortcode execution that enables arbitrary shortcode injection.
Mandates identification, reporting, and timely correction of flaws like the arbitrary shortcode execution vulnerability in WPCS plugin versions up to 1.2.0.4 via patching.
Limits and authorizes specific unauthenticated actions, preventing unauthenticated remote attackers from triggering the vulnerable plugin action leading to shortcode execution.