CVE-2025-2803
Published: 29 March 2025
Summary
CVE-2025-2803 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions through 0.1. The flaw stems from insufficient validation of an input value passed to the do_shortcode function, enabling code injection as classified under CWE-94. The issue received a CVSS 3.1 score of 7.3 with a network attack vector, low complexity, and no required authentication or user interaction.
Unauthenticated remote attackers can exploit the vulnerability by invoking an unprotected action that executes arbitrary shortcodes. Successful exploitation grants limited read, write, and impact capabilities on the affected WordPress site, potentially allowing shortcode-driven content manipulation or disclosure of restricted information.
EPSS scores for the CVE rose from a low baseline to a peak of 0.0135, indicating increased exploitation interest following public disclosure. The referenced sources, including the plugin repository and Wordfence threat intelligence, provide the primary details on the affected code and vulnerability scope.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8676
Vulnerability details
The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the software allowing users to execute an action that does not properly validate a value…
more
before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote arbitrary shortcode execution in a public-facing WordPress plugin via insufficient input validation before do_shortcode, directly enabling T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient input validation before invoking do_shortcode, preventing arbitrary shortcode execution by validating all user-supplied inputs.
Requires timely identification, reporting, and remediation of the code injection flaw in the So-Called Air Quotes plugin, such as patching or removal.
Vulnerability scanning identifies the arbitrary shortcode execution vulnerability in the plugin, enabling proactive remediation.