CVE-2025-2809
Published: 10 April 2025
Summary
CVE-2025-2809 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 31.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.0.2. The issue stems from the code path that accepts an action without validating its input before invoking do_shortcode, enabling injection of shortcode directives. This flaw is tracked as CWE-94 and carries a CVSS 3.1 score of 7.3.
Unauthenticated attackers with network access can supply crafted requests that trigger execution of arbitrary shortcodes. Successful exploitation yields limited but direct effects on confidentiality, integrity, and availability within the WordPress site, without requiring user interaction or elevated privileges.
The listed references point to the plugin's source repository, its WordPress.org page, and a Wordfence advisory entry, but do not detail specific patch versions or configuration workarounds beyond the general statement that the flaw affects releases through 2.0.2.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0135, indicating measurable post-disclosure interest in exploitation despite the modest absolute values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10471
Vulnerability details
The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a…
more
value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.