The Shortcode Ajax plugin for WordPress allows unauthenticated users to execute any shortcode via the WordPress template engine. The vulnerability arises from the lack of input validation on the 'code' parameter before calling do_shortcode. The impact of the flaw depends on the functionality of the shortcode that is executed, as shortcodes can perform a wide range of actions.

Vendors: rang501, Product: Shortcode Ajax, Version: all releases up to and including 1.0 are impacted. No further version information is available in the public data.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The attack vector is remote and does not require authentication, using the public 'code' endpoint. The vulnerability is not listed in the CISA KEV catalog. An attacker can execute arbitrary shortcodes; the resulting impact depends on what the shortcode does, which could potentially include data disclosure or other effects. This potential impact is inferred from the nature of arbitrary code execution.